Enterprise licensing server ha?

[colemtb_]

What happens if your mag / sa licensing server dies? Is there an ha option for these? What will the Ives do for licensing in the event of a failure? Ice required?

[MattS_ · Accepted solution]

If the license server becomes unavailable you cannot manage the license allocations on the client devices, the license allocations remain and the client devices operate as expected.

There is no HA for the license server - if it becomes unreachable there is a 5 day grace period (I believe increased to 10 days in 7.1R2 onwards) when the devices will continue to run with their leased licenses. The auto-leasing feature works when the license server is unavailable so the devices can increase their license counts (see http://www.juniper.net/techpubs/software/ive/guides/j-sa-sslvpn-7.1-licensemgmt.pdf).

A spare device can be used as a replacement license server and the configs from the failed license server loaded if the license server needs to be back on-line before an RMA of the failed device can be completed.

[colemtb_]

Nice thanks man!

[sudhirojha_]

Hi ,

Is it require to have seperate server license for spare license server or only importing config of faulty server will work?

how will it work in case of DR where the ip of spare server would be differnet than faulty serevr?

Regards

Sudhir Ojha

---

@MattS wrote:

If the license server becomes unavailable you cannot manage the license allocations on the client devices, the license allocations remain and the client devices operate as expected.

There is no HA for the license server - if it becomes unreachable there is a 5 day grace period (I believe increased to 10 days in 7.1R2 onwards) when the devices will continue to run with their leased licenses. The auto-leasing feature works when the license server is unavailable so the devices can increase their license counts (see http://www.juniper.net/techpubs/software/ive/guides/j-sa-sslvpn-7.1-licensemgmt.pdf).

A spare device can be used as a replacement license server and the configs from the failed license server loaded if the license server needs to be back on-line before an RMA of the failed device can be completed.

---

[michael.saw_]

Is there a solution for License Server HA in 7.3 or 7.4?

[zanyterp_]

No, there is no option for HA on the license server.

[muttbarker_]

Howdy - I just checked on this with an SSL product expert - here is the deal:

You can restore the config from a primary license server to a spare unit and put it online as a substitute within the 10 day grace period. The spare (must be identical hardware) and can run in RMA mode with a license mismatch for 90 days. 

[cmbhatt_]

What if you front the license server behind an F5 Load balancer?

Would that work?

CB

[muttbarker_]

You cannot have two license servers. The only solution is the workaround I described in a prior post. This is the unofficial, unsanction but blessed workaround from the Juniper "dudes"

[Kita_]

We have document our suggest solution for hot/cold license server failover in the following kb:

http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB22374&actp=search&viewlocale=en_US&sear...

Please file an ER with your Juniper account team to ask for a fully support HA license server solution.