Introduction
Managing user authentication and authorization requires ensuring high availability of the NAC system, since, in the event of its failure, connecting users and endpoints will become impossible.
Eltex NAICE high availability is implemented using an Active-Active scheme, where each node has its own IP address. The network equipment must be configured to interact with two RADIUS/TACACS+ servers. Service availability detection is performed by the network equipment side. To configure the high-availability scheme, four virtual (or physical) servers must be allocated: two for running NAICE services and two for running the PostgreSQL database, which is responsible for storing system data.
Installing or upgrading a high-availability configuration on a host previously used for operating the system in single-host mode is not allowed.
The procedure for switching from a stand-alone installation to a high-availability configuration is described in v1.2_3.9.5 Updating PostgreSQL during the transition from a stand-alone installation to a high-availability configuration.
General high-availability scheme
- High availability for NAICE is implemented using an Active-Active scheme. Network devices can send RADIUS requests to any NAICE server. Two radius-server host/tacacs-server host instances must be configured for each NAICE IP address.
- NAICE IP addresses may be located in different subnets. In this case, Layer 3 connectivity between subnets must be ensured using routing (without NAT or other address translation technologies). If a firewall is used, to ensure proper operation, traffic must be allowed to pass between nodes on the ports described in section v1.2_1.4 List of ports used by services in the article “Ports used by NAICE nodes in a high-availability deployment”.
- Administrative access via the GUI for system management is available to any node via its actual address.
- PostgreSQL database high availability is implemented using replication manager. Replication is configured on two nodes, which operate in the Primary and Standby roles.
- NAICE service database connection settings must include both database addresses.
To license a high-availability scheme, two licenses are required, one for each NAICE host. Each license must have its own Product ID while sharing the same license key.
Server system requirements
System requirements for the servers are described in the “High-availability deployment” section of v1.2_3.1 System requirements.
Installation
Both online and offline installation methods are supported.
Online installation is supported on all operating systems listed as supported and is described below.
Offline installation in an isolated network is described in section v1.2_3.6.1 High-availability installation in an isolated network (without using VRRP).
Online installation
To perform an online installation, the target hosts must have direct Internet access. Using a proxy server or any mechanism that modifies certificates of destination websites accessed during installation is not allowed.
You must specify IP addresses of the target servers during installation. Using domain names is not permitted.
The installation is performed using two Ansible playbooks:
- The PostgreSQL cluster is installed using the playbook
install-postgres-cluster.yml. - The NAICE services and the
keepalivedservice are installed using the playbookreservation-naice-services.yml.
Preparation for installation
The addresses of the target hosts on which the installation will be executed are defined in the inventory/hosts-cluster.yml file.
For PostgreSQL, set the addresses in the postgres-cluster section:
# Host group for postgres-cluster installation (primary + standby)
postgres-cluster:
hosts:
node_primary:
ansible_host: <IP address of PostgreSQL host 1>
ansible_port: 22
ansible_user: <username>
ansible_ssh_pass: <password>
ansible_become_password: <sudo password>
forwarded_postgresql_port: 5432
forwarded_ssh_port: 15432
node_standby:
ansible_host: <IP address of PostgreSQL host 2>
ansible_port: 22
ansible_user: <username>
ansible_ssh_pass: <password>
ansible_become_password: <sudo password>
forwarded_postgresql_port: 5432
forwarded_ssh_port: 15432
To install NAICE services with high availability, you must specify the addresses in the geo section:
# Host group for NAICE high-availability installation
geo:
hosts:
master_host:
ansible_host: <IP address of NAICE host 1>
ansible_port: 22
ansible_user: <username>
ansible_ssh_pass: <password>
ansible_become_password: <sudo password>
backup_host:
ansible_host: <IP address of NAICE host 2>
ansible_port: 22
ansible_user: <username>
ansible_ssh_pass: <password>
ansible_become_password: <sudo password>
When performing an online installation, it is not required to specify access credentials for the host from which the playbook is executed in the Local actions section. This section is used only when performing installation in an isolated environment.
Configuring Docker networks
Three Docker networks are used for NAICE services:
- External network (external);
- Internal network (internal);
- unmasked (naice-network-unmasked).
The variables used to configure Docker networks are defined in the group_vars/networks.yml file. The subnet, IP address range, and gateway are specified for each network.
Example contents of the group_vars/networks.yml file:
--- # Variables for configuring Docker networks docker_network_unmasked: subnet: "172.18.0.0/20" ip_range: "172.18.8.0/21" gateway: "172.18.0.1" docker_network_external: subnet: "172.20.0.0/20" ip_range: "172.20.8.0/21" gateway: "172.20.0.1" docker_network_internal: subnet: "172.21.0.0/20" ip_range: "172.21.8.0/21" gateway: "172.21.0.1"
The example shows the default values. If the networks overlap with existing networks in your infrastructure, you must change the network settings in the group_vars/networks.yml file before installing NAICE. Instructions for changing Docker networks on an already installed NAICE system are provided in the v1.2_3.13 Changing Docker networks article.
Installing the PostgreSQL database cluster
Run the playbook:
ansible-playbook install-postgres-cluster.yml -i inventory/hosts-geo.yml
As a result, PostgreSQL will be installed as a cluster on the servers specified in node_primary and node_standby. The master node of the cluster will be located on the node_primary host.
Installing the NAICE cluster
Before starting the installation, make sure that the Primary role belongs to the PostgreSQL node specified in the variable node_primary “ansible_host”. If necessary, perform a Primary role switch. If this requirement is not met, the installation cannot be completed.
Both database addresses are specified in the NAICE service database connection settings, and database entries can only be made via the primary server. The use of the targetServerType parameter in the URL is mandatory.
Example:
URSUS_POSTGRES_JDBC_URL:jdbc:postgresql://192.168.0.101:5432,192.168.0.102:5432/ursus?targetServerType=primary
The database access addresses are taken from the ansible_host values under the postgres-cluster section in the hosts-geo.yml file.
To start the installation, run the playbook:
ansible-playbook geo-naice-services.yml -i inventory/hosts-geo.yml
Checking the NAICE cluster state
2 Once the NAICE cluster installation is complete, the containers on both nodes should be in a healthy state.
On the hosts, navigate to the installation directory (by default, /etc/docker-naice) and verify that the containers are running.
System operation overview
Normal system state
In the normal state, all four hosts are functioning.
- RADIUS/TACACS requests can be processed on each node in the cluster;
- Service interaction with the database is performed using the two real addresses of the PostgreSQL cluster nodes. The node available for writing in the Primary state is determined automatically.
Failure of NAICE host 1
If NAICE Host 1 fails, the following actions will be performed automatically:
- When attempting to send packets to NAICE node 1, the network equipment will detect its unavailability according to the configured timeout and packet retransmission settings.
- Subsequent requests will be sent to NAICE node 2.
For details regarding the behavior of network equipment when working with two RADIUS/TACACS+ server hosts and for correct configuration recommendations, refer to the documentation for the corresponding equipment.
Failure of database host 1
If database host 1 fails, the following actions will be performed automatically:
- Database host 2 will automatically transition to the Primary role;
- NAICE services will detect that database host 1 is unavailable, and all further database operations will be performed through database host 2;
- RADIUS request processing will remain available on all three cluster addresses.
Recovery after failure
- After the NAICE host returns to operation, if it is configured as the preferred host in the network equipment settings, RADIUS/TACACS+ requests will resume being sent to this host.
- After the PostgreSQL database host returns to operation, it will run in Standby mode. The Primary role will remain assigned to the current cluster node.
Host recovery
If one of the hosts is completely lost, first restore its initial state: deploy the operating system, configure IP addressing and user accounts as they were before, and then perform the recovery procedure.
Recovering a PostgreSQL database cluster host
On the remaining operational node, create a backup of the data according to the instructions in v1.2_3.10 Creating and restoring database backup.
Redeploy the host corresponding to the failed cluster node, using the same OS, IP addressing, and user configuration as before.
Run the playbook:
ansible-playbook install-postgres-cluster.yml -i inventory/hosts-geo.yml
After completing the playbook, check the state of the PostgreSQL database cluster, verify that it is operational, and confirm that authentication and configuration in the GUI are functioning correctly.
Recovering a NAICE service host
Redeploy the host corresponding to the failed cluster node, using the same operating system, IP addressing, and user configuration as before.
Run the playbook:
ansible-playbook geo-naice-services.yml -i inventory/hosts-geo.yml
When the installation is executed again, all NAICE services will be restarted, which will result in a short service interruption (up to 5 minutes). This must be taken into account when planning recovery work.
After recovery, verify that authentication is working correctly and ensure that all services are operating properly.