Deplyment ACS 5.8 secondary instance

[michell_js72]

Hi:

I have one simple question, I want to implement a secondary instance to my server ACS. Those servers have to be in the same network?? This is necesarry for replication?.

Because right now each one have its own net.

Thanks.

[GRANT3779 · Accepted solution]

Hi,

I run ACS 5.6 in a distributed deployment, one primary and one secondary instance. These are L3 separated over my wan. I do not think they need to be layer 2 adjacent only for a distributed setup.
https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-8/user/guide/acsuserguide/admin_operations.html#87956

[michell_js72]

Thanks a lot! GRANT3779 just one more question. How is the configuration for the devices? I have to configure the tacacs server lines for the primary and secondary instance? 

[GRANT3779 · Accepted solution]

So as an example here is a snip from my own config for the actual servers, then you would add your aaa commands. I believe the first server in group is tried first and then the second one if the first is down, however both your primary instance and secodary instance will be able to serve TACACs requests on demand (e.g if you only had your secondary listed below, authentication will still work)

aaa group server tacacs+ ABZ_ACS
 server name TAC1
 server name TAC2

tacacs server TAC1
 address ipv4 x.x.x.x
 key 7 .....
tacacs server TAC2
 address ipv4 y.y.y.y
 key 7 ......

[michell_js72]

Thanks so much