Security

My current architecture is as follows:

• Publisher in AWS US-East VPC
• Subscriber in Boston, MA
• Subscriber in Dublin, Ireland
• (new) Subscriber in Singapore

We have additional plans for subscribers in various regions, and a standby Publisher somewhere else in the world.  However, upon adding the Singapore appliance to the cluster I've noticed that it's consistently "Out of Sync".  I opened a TAC case and they've pointed to the following documentation:

1. Most likely due to latency.  200ms is the maximum supported RTT time between ClearPass nodes.  This means that any policy changes on the publisher may not be properly replicated to the subscriber.  Logging is also likely to be impacted
2. See above. https://www.arubanetworks.com/techdocs/ClearPass/6.10/PolicyManager/Content/Deploy/Cluster%20Deployment/Design_guidelines.htm#Geo
3. Decrease latency by moving publisher to a more central location or deploying multiple ClearPass clusters.

I never deploy standby publisher as I want to know why/if a real issue occurs before I choose to failover.   The only environments I deploy standby publisher in are those that actually use the features that require an active publisher in the deployment (guest self-registration, MDM integration, etc.):

Functions Lost When the Publisher Is Down

When the active Publisher goes out of service, the following ClearPass Policy Manager functions are temporarily lost:

AirGroup and MACTrac enrollment

Certificate creation and revocation

Certificate revocation list updates

ClearPass Exchange outbound enforcement

General ClearPass Policy Manager and ClearPass Guest configuration changes

ClearPass Guest account creation

Mobile device management endpoint polling and ingestion

Onboarding functionality

Hi

I agree with the answers from ahollifield, your problem is related to the latency.
A few years ago I had a customer with cluster nodes in London and New York. Due to VPN tunnels we had an issue with latency between the sites and sometimes got really poor performance. If the subscriber is out of sync for a long time, more than 24 hours, the syncronization will not re-establish automatically.
In that case you have to drop the subscriber from the cluster and join again.

The subscriber will continue to authenticate clients locally, but will not get any new configuration. As mentioned in this situation the function will be limited in the same way as if the Publisher is down.

For global deployments of ClearPass multiple clusters are usually the best solution.
You have an option to utilize the ClearPass Syncronization Service to replicate configuration data between multiple clusters. But this service have a quite high price tag, so I would only use it in very special cases.
I evaluated this service for one of my customers with multiple ClearPass clusters and in total about 15 servers, but found the price tag to high.

------------------------------
Best Regards
Jonas Hammarbäck
ACCX #1335, ACMP, ACDP, ACNSP, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------

Thank you both - these answers were extremely helpful!

Scott

Original Message:
Sent: Nov 11, 2022 11:07 AM
From: Jonas Hammarback
Subject: ClearPass Publisher-Subscriber HA Best Practice

Hi

I agree with the answers from ahollifield, your problem is related to the latency.
A few years ago I had a customer with cluster nodes in London and New York. Due to VPN tunnels we had an issue with latency between the sites and sometimes got really poor performance. If the subscriber is out of sync for a long time, more than 24 hours, the syncronization will not re-establish automatically.
In that case you have to drop the subscriber from the cluster and join again.

The subscriber will continue to authenticate clients locally, but will not get any new configuration. As mentioned in this situation the function will be limited in the same way as if the Publisher is down.

For global deployments of ClearPass multiple clusters are usually the best solution.
You have an option to utilize the ClearPass Syncronization Service to replicate configuration data between multiple clusters. But this service have a quite high price tag, so I would only use it in very special cases.
I evaluated this service for one of my customers with multiple ClearPass clusters and in total about 15 servers, but found the price tag to high.

------------------------------
Best Regards
Jonas Hammarbäck
ACCX #1335, ACMP, ACDP, ACNSP, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------

We had the same issue when we installed a subscriber node in Singapore as well. Publisher is in the Chicago area.  Had constant out of sync issues.  Someone at TAC told me to try changing one parameter to see if it helps. Resolved my issues, SG hasn't been out of sync since, 4+ years and no issues.

Administration > Server Configuration > Cluster-Wide Parameters > Database > Change Replication Batch Interval from the default 5 to 15. 

Original Message:
Sent: 11/23/2022 1:32:00 PM
From: ajezierski
Subject: RE: ClearPass Publisher-Subscriber HA Best Practice

We had the same issue when we installed a subscriber node in Singapore as well. Publisher is in the Chicago area.  Had constant out of sync issues.  Someone at TAC told me to try changing one parameter to see if it helps. Resolved my issues, SG hasn't been out of sync since, 4+ years and no issues.

Administration > Server Configuration > Cluster-Wide Parameters > Database > Change Replication Batch Interval from the default 5 to 15.