topic Re: REST API and HA in General Topics

REST API and HA

djr — Wed, 22 May 2013 12:59:34 GMT

If I use the REST API to pass user ID mappings from my RADIUS servers into the firewalls, what should I do when they are in an HA pair?

Because I don't necessarily know which with be the active one, should I just write to one and if that fails, swap to the other (will work if they pass user info between them) or do I have to write all updates to both simultaneously to ensure that the active one has the data?

Thanks in advance

Oh, while I am in here, how can I see if it is working? With the XML API to the server user id agent, there was a log I could query, but I can't see anything similar on the device.

Re: REST API and HA

Jamiefitzgerald — Wed, 22 May 2013 17:28:50 GMT

User-IP mappings are synchronized between two firewalls if in a HA pair. This needs to be done especially because if one firewall learns an IP address for a user via captive portal or XML-API, the information needs to be synchronized to the other device since the User-ID agent never gets it and can therefore never provide it in case of a failover. Therefore, as long as both devices are connected and syncing data, you can pick one and it will sync to the other. The best choice is to choose the Active-Primary device.

Re: REST API and HA

djr — Thu, 23 May 2013 10:36:28 GMT

Thanks jf, that is great.Do you happen to know how I can see if the XML interface is working, other than seeing users resolved in the traffic logs?