WSA clustering / configuration sync

[Marcel Maeder]

Hello

Is it possible to build a cluster with two WebSecurity Appliances? Or at least synchronize the configuration?

Regards Marcel

[Francisco Rodriguez · Accepted solution]

Hello:

    Officially this is not supported out of the box, you need the Ironport M appliance to centralize and distributed the same config to the other WSA.
    Since not always everything it's an absolute truth, there is a way using a linux box in the middle acting as an Ironport M that is able to register these changes and populate them to the rest of WSA, but this solution was built in house and work pretty well. The problem is that it's not supported by Cisco.

Regards

Francisco Rodriguez P.

[ymadheka]

Hi Team,

Do we still require M-series to do the above, have read in the documentation about the master slave configuration of WSA appliances to do the policy synchronization.

[Tao Yang · Accepted solution]

WSA cluster is only for data traffic. You still need SMA for centralized policy management.

[ymadheka]

Hi Tao,

Thanks for the quick revert.

Does it require any specific version for the clustering to work, wanted to ensure that we are running the compatible version at customer end.

[Tao Yang]

WSA HA was introduced in WSA version 8.5.x. Please refer to the following release notes for more details. Hope it helps.

http://www.cisco.com/c/dam/en/us/td/docs/security/wsa/wsa8-5/WSA_8-5-x_Release_Notes.pdf

[yohannugera]

If we have a management appliance in the middle, what is the sort of clustering applicable in this scenario? Active/Active or Active/Standby?