Active sync between 2 SA clusters

[irtizas_]

Hi,
If I have two clusters at two sites, one for live and one for DR, it is possible to set up an automated active sync between the two boxes to sync everything apart from the IP information.
So if I make a change on one box it will get synced to the other.

[zanyterp_]

In the sense of you make a change on production and it pushes to DR, no, it is not possible. You can use items as described to automate the task, but it will need to be initiated manually.

Another option would be to use NSM and manage both sides from this software and push the changes that way.

[MattS_]

Devices in the cluster will synchronize their settings, there is no default way to automate synchronization with devices outside the cluster.

What you can use is the Push Config feature (Maintenance -> Push Config) , which will allow you to trigger sending the whole or partial configuration from one SA to others. Please read p.796 onwards in http://www.juniper.net/techpubs/software/ive/admin/j-sa-sslvpn-7.1-adminguide.pdf for more details.

To automate the sync would require scripting - for example set up automated archiving of the XML config (Maintenance -> Archiving) and then use DMI (http://www.juniper.net/techpubs/software/ive/guides/j-sa-sslvpn-7.1-dmiguide.pdf) to edit the config on the SAs that needs the new configuration.

[RexPGP_]

We are testing ultra dns and same url on two separate VPNs via external load balance. Need to generate verisign cert on web and export out to import to separeate SSL VPNs. So far only NOKIAS complain. Iphones and droids seem to be OK bouncing.