PAM High Availability (HA) Installation Scenarios

This section looks at HA Pair installation scenarios:

Introduction

Here we describe and illustrate installation scenarios of how organisations may implement different configurations of a PAM HA Pair. This will help you to plan your implementation based on the needs of your organisation.

Installation scenarios

Scenario A: HA Pair in same subnet

In this installation both HA PAM Servers reside on the same subnet with a floating IP used for user connections.
Scenario B: HA Pair in different subnets

In this installation both HA PAM Servers reside on different subnets. A floating IP cannot be used.
Scenario C: HA Pair in different Subnets and using a load balancer

In this installation both HA PAM Servers reside on different subnets and a load balancer is used to direct user connections to the active server. A floating IP cannot be used.
Scenario D: HA Pair using PAM UI Servers in different subnets and using a load balancer

In this installation both HA PAM Servers and PAM UI Servers reside on different subnets.

Scenario A: HA Pair in same subnet

Installation summary:

Stretched VLAN either in the same or different data centres
HA Pair (IP address: A, B) and floating IP (C) are all on the same subnet
Primary server is active
Secondary server is on standby
Floating IP used by user to log on
Manual failure is required by running the ha-failover command on the Management Interface of the Secondary server
IP address does not change during failure as a floating IP is being used

HA Servers In Same Subnet

Scenario B: HA Pair in different subnets

Installation summary:

Separate VLANS either in the same or different data centres
HA Pair (IP address: A, B) are on separate subnets
Floating IP cannot be used
Primary server is active
Secondary server is on standby
PAM User logs onto the active server
Manual failure is required by running the ha-failover command on the Management Interface of the Secondary server
After failover, users need to switch over to the IP of the Secondary server (B)

HA Pair Servers In Different Subnets

Scenario C: HA Pair in different subnets and using a load balancer

Installation summary:

Separate VLANS either in the same or different data centres
HA Pair (IP address: A, B) are in separate subnets
Floating IP cannot be used
Primary server is active
Secondary server is on standby
Manual failure is required by running the ha-failover command on the Management Interface of the Secondary server
The load balancer (C) monitors through an API and directs user traffic to the active server. For information on how to configure a load balancer in front of a PAM HA Pair click here
PAM User uses a virtual IP address configured on the load balancer (C) to log on
IP address does not change during failure as a virtual IP is used

PAM HA Pair in Different Subnets and Using A Load Balancer

Scenario D: HA Pair using PAM UI Servers in different subnets and using a load balancer

Installation summary:

Separate VLANS either in the same or different data centres
HA Pair (IP address: A, B) and PAM UI Server (IP address: X, Y) either in the same or different data centres
Primary server is active
Secondary server is on standby
Manual failure is required by running the ha-failover command on the Management Interface of the Secondary server
Host file configured on the PAM UI Servers (IP address: X, Y) to include floating IP or HA Pair (A, B) IP addresses to connect to the active server
PAM User uses a virtual IP address configured on the load balancer (C) to log on
IP address does not change during failure as a virtual IP is used

Scenario D: PAM HA Pair Using PAM UI Servers In Different Subnets