Does anyone out there have experience of using multiple NAC appliances with the self registration portal in an LSNAT load balancing configuration?
I have just added a second NAC appliance to an existing working setup, and configured load balancing for RADIUS auth. The RADIUS side of things seems to be working fine, however what to do about the web portal? I'm not doing any assessment BTW.
- A client connects to my guest VNS, which uses web redirect to an external captive portal running on the NAC appliance 1.
- The RADIUS auth for the VNS is sent to the load balancer VIP.
- Let's assume the auth goes through the load balancer and happens to go to the second NAC box (the one that's not running the web portal).
- NAC processes the auth correctly, and appears to send back the correct policy to the wireless controller (verified looking at NAC end system log).
- Then something goes wrong, my end system disappears from the end system log and my client is kicked off. My wireless controller never applies the policy. The client is stuck with the default policy while this is going on, before getting kicked.
I notice in the NAC appliance interface options there is a feature to "mirror" the guest portal across a number of appliances. But the manual is very short on detail about what this is actually does - do I have to set this up?
Is it even valid to run two appliances in load balancing mode, but only have the guest portal running on one?
If I change my guest VNS auth RADIUS server back to the real IP of the first NAC appliance (running the portal) everything starts working fine again.
Oh - and another question.
As I have added a new NAC appliance presumably I should be forwarding DHCP traffic from my guest LAN to both appliances to help with IP resolution? When this goes live, I won't know which NAC will be dealing with the auth for that client.
Any pointers would be great.