About horsefeathers_

horsefeathers_ · ‎07-23-2012

Thank you! That answers my question. I appreciate everyone's assistance with this, thanks.

horsefeathers_ · ‎07-18-2012

Hi, Thank you both for your responses. I just verified my cluster status, and it does show active/active. What was it that seemed otherwise? I wasn't sure if there was any difference for the IC vs IVE use of certificates, thanks. I am using these IC's with L3 ScreenOS enforcers. Only the internal interface is active on both cluster members. I understand the intent in re-mapping the certificates, however the difficulty is that the interface is not visibly available to unmap on the expired cert. Please see the attached. Since this is actually an active/active, the document you referred to was unavailable for certificate needs. What does it recommend, please? thank you!

horsefeathers_ · ‎07-16-2012

I have a few questions regarding certificates on an active/active IC 6500 cluster: 1)Should cluster members each have their own certificate, or should there be a single cluster certificate? Currently mine have individual certs, with the 'leader's' associated with the 'primary internal port', and the 'enabled's' associated with the 'cluster internal VIP'. Everything works fine, but what is best practice? 2) Replacing (not just Renewing) an expired cert on the 'enabled', I'm unable to break the port association with the expired cert because the 'Cluster internal VIP' seen to be associated with it on the Configuration Certificates page isn't visible when I go into the Certificate Details page. Is there another location I should look? 3) I will soon need to change domain names on the cert(s). Since they expire at different times, will they both - if two are recommended - need to be changed simultaneously? thanks!

horsefeathers_ · ‎05-21-2010

An upgrade prompt of some sort was what I wondered about, but wasn't sure. By turning off the upgrade possibility, it would continue to communicate with the original IC, but wouldn't necessarily see the newly clustered IC, correct? It will need to pull down the secondary server ip info, and/or the new cluster name in the upgrade to gain that? thanks.

horsefeathers_ · ‎05-21-2010

I have a currently deployed IC6500 which I will be clustering with a second IC6500, but have not yet located any info on what the current OAC users should expect. Will they be notified that they need to pull down an update with the new IC information, as they are when the IC6500 is upgraded?

Re: IC cluster certificate(s)?

Re: IC cluster certificate(s)?

IC cluster certificate(s)?

Re: Odyssey updates for new cluster?

Odyssey updates for new cluster?