ACS 4.2 Database replication issue

Hello Experts,
Hope you are all doing well. I need your help in ACS database replication, I want to do replication between ACS servers. The issue i am facing is that there is no error in ACS replication log. It just says outbound replication started. and sits there no other error message is shown. I can successfully telnet secondary server's destination port 2000. But when i hit the replication button from primary server, i do not observe any hit count on my ASA ACL on which i allowed tcp 2000 for destination secondary server.I also checked my syslog server if there is any traffic denied between these 2 ACS servers but found nothing. I also did wireshark captures on the interfaces but no traffic is initiated when i press replicate now button. Initially i thought its a machine issue, but same behavior is shown when i swapped primary----to secondary. There are other applications running on both the servers which requires JAVA. Like Cisco IME etc. Can it be JAVA issue? Please help me out. i am using Release 4.2(0) Build 124 on both servers.Attached below is the Replication LOG snapshot,
Regards,
Rizwan.

https://supportforums.cisco.com/discussion/11382366/problems-witch-acs-42-replication
https://supportforums.cisco.com/discussion/11363046/replication-problem-acs-ver-42

Similar Messages

ACS 4.2 to ACS 5.4 database replication

Hello All,
I would like to know if its possible setup database replication from Cisco ACS 4.2 server to ACS 5.4 server ?
Thanks in advance
Mohsin Saleem

Unfortunately, database replication (trigger update) cannot be performed as it requires both the ACS boxes to run same code.
If you meant migration then yes that can be done.
Migrating from ACS 4.x to ACS 5.4
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/migrate.html
Jatin Katyal
- Do rate helpful posts -

Problem with ACS 4.2 Database replication

Greetings,
I am not able to replicate Database between two ACS SE 4.2. I am getting the following error:
Inbound database replication from ACS 'ACS_BEX_001' denied - shared secret mismatch.
The configuration apparently is ok. I am attaching the configuration from both ACS.

The solution posted by Nevin is correct, but I must add some explanations. I had the problem yesterday and I proceeded like Nevin told:
- I connected to the console and made a "show".
- The IP was the correct one, but as indicated I made a "set ip"
- The system asked for the new IP, showing the old one between brackets: ie "New IP [10.10.10.1]:"
- I pressed Intro, because the IP is correct.
- After confirming the IP, mask, gateway and DNS the system asked me to verify connectivity. I did it and was correct.
- The second time it asked to check connectivity I answered No. and nothing happened.
- We checked through the web but the "Self" IP was still 127.0.0.1.
- So I made the process again BUT this time I changed the the IP to another one. After finishing, (when I answered No to check connectivity) I saw that the system was stopping all ACS processes and starting then again.
- In the web page the "Self" IP was the new one.
- I made the process again changing the IP to the original one. This time also the system stopped and started all processes.
- In the web page the "Self" IP was correct.
- Now the replication worked correctly.
So the problem was that the system is "inteligent" and if it discover that you don't change the IP (even if you change the DNS), it doesn't reconfigure it. So you must change to another IP (even a dummy one) and the change again to the correct one.
I hope this can help to other people.

ACS replication issue on VMware ESX 3.5

I have just installed ACS 4.2 on two VMware hosts. I've configured database replication but it won't work. The error message is "shared secret mismatch". This error message occurs if a NAT device is in the path (which it isn't in this case) or if the tcp header is otherwise changed during transmission. I'm wondering if VMware is adding something to the TCP header. Has anyone come across this problem before or has anyone successfully implemented ACS replication when both hosts are on VMware?
Thanks.

Hi,
I see that you are getting "shared secret mismatch error" under database replication logs. Just wanted to inform you that this is not because of nat'ed device. This happens when we have different keys for AAA servers on primary and secondary ACS.
The primary server must be configured as an AAA server and must have a key.
The secondary server must have the primary server configured as an AAA
server and its key for the primary server must match the primary servers own
key. The shared secret key should be same on the both the ACS's.
I am sending you one link for Setting Up Replication for Cisco Secure ACS, I
am sure this example with screen shots gives you better understanding.
Please visit the below suggested ULR:
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration
_example09186a00800e518a.shtml
If that doesn't resolve the issue, please let me know if you see any server with this ip address 127.0.0.1.
HTH
JK
-Plz rate helpful posts-

ACS 4.2 replication issue

We recently upgraded to ACS 4.2. All works perfectly except for replication. I now receive an error
ACS Internal Database Replication Errors
1.To disable receiving of EAP-FAST replication component, "EAP-FAST master server" must be enabled on "Global Authentication Setup" page
We are not using EAP-FAST and it doen't appear to be enabled. EAP-FAST is not checked to replicate.

I looked at that when I first got the issue. It saya that the server is Master. If I tick the box nothing changes and when I go back to that "Global Authentication" page the box is no longer ticked. The issue is the same on both the Primary Server and the Backup Server.

ACS Database Replication over VPN with overlapping Network Addresses

We currently have two co-locations each situated in different provinces. We have two ACS servers which we want to deploy at each co-location. All our network equipments are behind PIX/ASA devices. Getting them to replicate over the VPN should be easy but in our case we have overlapping Network Addresses at both ends of the tunnels.
As per Cisco data does not transit a NAT device when the two Cisco Secure ACS servers communicate and a successful database replication can occur only if the secondary ACS server perceives no change in the IP header or content of the data it receives. So that means we will not be able to Implement NAT to achiever this.
Has any one of you faced this problem of replicating ACS Database over the VPN with overlapping Network Addresses and was anyone able to successfully solve this issue using a work around ?
All provided info and comments are greatly appreciated.

I can help with the 3005 setup if you decide to go that route.
You will need to add 2 network list entries under Configuration>Policy Management>Traffic Management>Network Lists.
You will need to configure a local and remote address. The local will be one of the public ip's for the site.(Provided by your ISP)The remote will be the device you are connecting to on the other end.
You will also need to add a Nat Lan to Lan rule under Configuration>Policy Management>Traffic Management>Nat>Lan to Lan.
Use a static Nat type. The rest will look similar to my example.
Source(Local address)Translated(Public Ip Address used in the network local list)Remote(Ip address of the device on the other end)
Now just create an Ipsec lan to lan tunnel. You will need to agree with the ISP on des type and auth type. Use you local and remote networks you created earlier.

ACS SE Database replication fails

Hello, I recently upgraded our ACS SEs from 4.0 to 4.1. All appeared to go OK but I checked the logs recently and saw the the database replication is failing with the message:
ACS '[hostname]'is running a different version of ACS - aborting.
All ACS SE were upgraded at the same time and display the same versions when examining the Appliance Upgrade page. Does anyone have any ideas what the problem is?
Thanks in advance.

Hi, I am having a related problem but in my case I am using ACS for Windows ver.4.0. I am replicating from one primary ACS to three other ACS using scheduled nightly replication.
The problem is that the data is being updated on all three ACS servers, but in the database replication logs on the primary I get messages stating that "ACS-server-name replication failed possibly due to short time-out or dead". Moreover, not all three servers timeout. Sometimes one server timeout, and other times two servers timeout, etc.
On the replicated servers logs, the only log, in case server times out, shows that "replication cycle starting....". while when replication is successfull, it also shows Replication cycle completed successfully.
I have played around with the timeouts but the result is random. I have also checked if there are any bandwidth issues, but replication is scheduled at night with minimal network traffic and the servers are also not being used for authentications.
Don't understand why I don't see successful messages all the time, specially when the data does get updated on the replica ACS.
Thanks.
MAG

Replication issues with ACS for Windows 3.3.3 build 11

I have built two ACS for Windows servers on Windows 2003 SP1. The AD environment is Windows 2003 SP1 as well. I have configured the two ACS servers on each box. However, when I go to replicate from box A to box B, the following error appears:
Inbound database replication from ACS 'acsradius.asu.edu' denied - shared secret mismatch
I have double checked the shared secret keys on both servers in the Network Configuration AAA servers section. Any idea what the issue is?
Thanks.

Do not run replication to a server installed on Windows 2003. Due to changes in the way Win2003 handles registry changes, each change can take up to 100 times longer and replication can fail and the server hang.

CiscoSecure ACS 4.1(1) Build 23 Patch 5 :database replication fails; possibly short timeout or dead

Hi,
Since some time we are struggling to get database replication working.
On the primary server it is reporting the following on "Database Replication active.csv""
07/21/2010
14:22:58
SZ0910
WARNING
ACS 'SZ0920' not replied to replication request - possibly short timeout or dead
07/21/2010
14:12:08
SZ0910
INFO
Outbound replication cycle starting...
In CSMon.log following is logged:
CSMon 07/21/2010 14:12:11 A 1544 13760 Pausing the monitoring of CSAuth for duration 600
CSMon 07/21/2010 14:12:11 A 1544 11640 Pausing the monitoring of CSLog for duration -1
CSMon 07/21/2010 14:12:14 A 1544 13788 Pausing the monitoring of CSRadius for duration -1
CSMon 07/21/2010 14:12:18 A 0641 3248 CSAuth: Paused State 0 6 Event Detected Level:2 Message:Service CSAuth has been suspended for a configured function to proceed. Monitoring will suspend until the service is restarted
CSMon 07/21/2010 14:12:18 A 0641 3248 CSLog: Stopped State 0 6 Event Detected Level:2 Message:Service CSLog has been stopped or paused by the system. Monitoring will suspend until the service is restarted
CSMon 07/21/2010 14:12:18 A 0641 3248 CSRadius: Stopped State 0 3 Event Detected Level:2 Message:Service CSRadius has been stopped or paused by the system. Monitoring will suspend until the service is restarted
CSMon 07/21/2010 14:12:18 A 1544 7716 Pausing the monitoring of CSTacacs for duration -1
CSMon 07/21/2010 14:12:28 A 0904 3248 Analysis: Level 2 'Service CSAuth has been suspended for a configured function to proceed. Monitoring will suspend until the service is restarted. Service CSLog has been stopped or paused by the system. Monitoring will suspend until the service is restarted. Service CSRadius has been stopped or paused by the system. Monitoring will suspend until the service is restarted. '
CSMon 07/21/2010 14:12:33 E 0351 3248 Failed to log accounting packet to logger localCSLog
CSMon 07/21/2010 14:12:33 A 0641 3248 CSTacacs: Stopped State 0 2 Event Detected Level:2 Message:Service CSTacacs has been stopped or paused by the system. Monitoring will suspend until the service is restarted
CSMon 07/21/2010 14:12:43 A 0904 3248 Analysis: Level 2 'Service CSTacacs has been stopped or paused by the system. Monitoring will suspend until the service is restarted. '
CSMon 07/21/2010 14:12:48 E 0351 3248 Failed to log accounting packet to logger localCSLog
CSMon 07/21/2010 14:22:18 A 0641 3248 CSAuth: State 0 6 Event Detected Level:4 Message:Service pause timed out. Please check the timeout settings for Replication and Backup
I have followed this checklist: https://supportforums.cisco.com/docs/DOC-8795 to make sure configs are ok.
But still replication fails.
There is no firewall in between.
Both ACS servers running on MS Windows Server 2003, SP2.
Can anybody help me in the right direction what could be possible cause of this or where else I can look for logging for further troubleshooting?
Thanks in advance for your help.

Hi,
Since some time we are struggling to get database replication working.
On the primary server it is reporting the following on "Database Replication active.csv""
07/21/2010
14:22:58
SZ0910
WARNING
ACS 'SZ0920' not replied to replication request - possibly short timeout or dead
07/21/2010
14:12:08
SZ0910
INFO
Outbound replication cycle starting...
In CSMon.log following is logged:
CSMon 07/21/2010 14:12:11 A 1544 13760 Pausing the monitoring of CSAuth for duration 600
CSMon 07/21/2010 14:12:11 A 1544 11640 Pausing the monitoring of CSLog for duration -1
CSMon 07/21/2010 14:12:14 A 1544 13788 Pausing the monitoring of CSRadius for duration -1
CSMon
07/21/2010 14:12:18 A 0641 3248 CSAuth: Paused State 0 6 Event Detected
Level:2 Message:Service CSAuth has been suspended for a configured
function to proceed. Monitoring will suspend until the service is
restarted
CSMon 07/21/2010 14:12:18 A 0641 3248 CSLog: Stopped State
0 6 Event Detected Level:2 Message:Service CSLog has been stopped or
paused by the system. Monitoring will suspend until the service is
restarted
CSMon 07/21/2010 14:12:18 A 0641 3248 CSRadius: Stopped
State 0 3 Event Detected Level:2 Message:Service CSRadius has been
stopped or paused by the system. Monitoring will suspend until the
service is restarted
CSMon 07/21/2010 14:12:18 A 1544 7716 Pausing the monitoring of CSTacacs for duration -1
CSMon
07/21/2010 14:12:28 A 0904 3248 Analysis: Level 2 'Service CSAuth has
been suspended for a configured function to proceed. Monitoring will
suspend until the service is restarted. Service CSLog has been stopped
or paused by the system. Monitoring will suspend until the service is
restarted. Service CSRadius has been stopped or paused by the system.
Monitoring will suspend until the service is restarted. '
CSMon 07/21/2010 14:12:33 E 0351 3248 Failed to log accounting packet to logger localCSLog
CSMon
07/21/2010 14:12:33 A 0641 3248 CSTacacs: Stopped State 0 2 Event
Detected Level:2 Message:Service CSTacacs has been stopped or paused by
the system. Monitoring will suspend until the service is restarted
CSMon
07/21/2010 14:12:43 A 0904 3248 Analysis: Level 2 'Service CSTacacs has
been stopped or paused by the system. Monitoring will suspend until the
service is restarted. '
CSMon 07/21/2010 14:12:48 E 0351 3248 Failed to log accounting packet to logger localCSLog
CSMon
07/21/2010 14:22:18 A 0641 3248 CSAuth: State 0 6 Event Detected
Level:4 Message:Service pause timed out. Please check the timeout
settings for Replication and Backup
I have followed this checklist: https://supportforums.cisco.com/docs/DOC-8795 to make sure configs are ok.
But still replication fails.
There is no firewall in between.
Both ACS servers running on MS Windows Server 2003, SP2.
Can
anybody help me in the right direction what could be possible cause of
this or where else I can look for logging for further troubleshooting?
Thanks in advance for your help.
Hi,
Also check the port number TCP 2000 this is the replication port which needs to be opened between the primary and secondary ACS.
Hope to Help !!
Ganesh.H

ACS internal database replication

I have setup ACS internal database replication and it works once then the secondary config is overwritten and doesn't contain the AAA server of the primary.
primary - 10.100.253.25
ACS 1113 running 4.2
secondary - 10.100.253.26
ACS 1113 running 4.2
Example of before and after
Before replication
The primary has these AAA servers listed under network components.
self - 127.0.0.1
acs2 - 10.100.253.26
The secondary has these AAA servers listed under network components.
self - 127.0.0.1
acs1 - 10.100.253.25
After replication
The primary has these AAA servers listed under network components.
self - 127.0.0.1
acs2 - 10.100.253.26
The secondary has these AAA servers listed under network components.
self - 127.0.0.1
acs2 - 10.100.253.26
therefore after the first replication subsequent attempts will fail because the secondary won't accept attempts from unknown AAA servers. Is this to be expected or can I mitigate it in someway?

Please try setting the original ip address by using "Set ip" Command from the console connection of the ACS Solution engine. Once you successfully changed the ip address, you can apply the patch 11 or above (latest is patch 16) on the ACS SE (This will fix the problem).
In majority of cases set ip command fails but sometime works too.
In case it doesn't help then we have 2 options:
1.] Open a TAC case, send the database file to delete the entry.
2.] If you are not intrested sending your database then try the below listed steps:
In order to remove the loopback entry from the Database, we need to follow following steps,
Please download ACS 4.2 trial from following link, if you do not have ACS Full version for Windows purchased.
http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-eval- eval-ACS-4.2.0.124-SW.zip
[1] Install eval version on Windows 2000/2003 server. Please also ensure that JAVA is installed on that server.
[2] Take a backup from ACS SE from, System Configuration > ACS Backup >Backup Now.
[3] Restore the database backup on ACS eval.
[4] On eval ACS , go to Network Configuration > find the AAA Server entry with 127.0.0.1 entry. Edit it and give it some other IP for
example, 1.1.1.1. Submit + Apply.
[5] On eval, Restart CSAdmin service.
[6] On eval, go back to Network Configuration and search for the changed IP address and delete that entry, Delete + Apply.
[7] Take a backup from eval ACS, System Configuration > ACS Backup > Backup Now.
[8] Restore the database backup from eval ACS into ACS SE from option, System Configuration > ACS Restore, choose the database backup. Check Check option "User and Group Database" and "CiscoSecure ACS System Configuration", then press Restore Now.
[9] On ACS SE, go to Network Configuration, make sure that 127.0.0.1 entry is not there and for ACS SE's hostname we have the correct IP address. Go to Proxy Distribution Table > (Default). Move the server’s hostname entry that has correct IP for this ACS SE into "Forward To" column, if not already. Then press "Submit + Restart".
Reference defect, CSCso36620 - Toggle nic command changes AAA server ip address to "127.0.0.1" in GUI.
Regards,
Jatin
Do rate helpful posts-

ACS Database Replication

I have 2 ACS server
- ACS Appliance(v4.0)
- ACS Server fo Window(v3.0)
I want to design Primary ACS Appliance and Secondary ACS for Window
I know the method For ACS Database replication
Thanks
cheolhyeon

Hello Hanwu
Please send a the screenshot of replication page from primary server.
thanks
Devashree

ACS Database Replication between SE and Windows

I currently have 2 Windows ACS servers (4.0.1.27) in production and replicating databases. I also have a solution engine (appliance) running 4.1.4.13.7. I plan to upgrade the Windows ACS servers to 4.1.4.13.7 (same as the SE). I know that the software versions have to match for replication to work. Recently, I received conflicting information about database replication. I was told that a ACS SE (solution engine 1113) can not replicate to a Windows ACS server, even if the software versions match. Before I change my production environment, I thought would seek out additional input.

Yes, you can replication acs windows with acs appliance. It works fine.
Regards,
~JG

ACS Replication Issue

Yesterday we had two ACS 4.0 servers installed on Windows 2000 Domain Controllers that were working great. ACS1 was the primary server and replication was configured to send to ACS2. ACS2 replication was configured to receive from ACS1.
We lost ACS2 yesterday so I installed ACS 4 on a 2003 Domain Controller (ACS3). I installed ACS3, went into network configuration and added ACS1 as an AAA server.
I then logged onto ACS1 and added ACS3 as an AAA server and configured ACS3 as a replication partner.
It is not replicating - if I look at the log I get
ERROR, ACS 'ACS3' has denied replication request
I do not have the primary as a replication on the secondary.
I have some screen shots of the configuration from ACS2 and I've duplicated everything I've could (except for name and IP).
Any ideas on what I can try next?

I had what seems to be the same issue.
In my case I have two ACS SE 1113 appliances, but the issue could still be the same with your Windows servers.
The appliance has two NIC's - I had both of the NIC's connected. Although the appliance only allows you to use the Primary NIC (the bottom one) ACS still detected the Secondary NIC and creates an additional "AAA Server" entry under the "Network Configuration" tab called "self". You should only have one "self" entry in your AAA Server list, not two.
Unfortunately I couldn't find a way to undo this. So I disconnected the Secondary NIC (the top one) and used the recovery CD to reload both of my ACS devices. Now everything works just fine.
- Nate

ACS 5.4 database view reinitialization question

Hello all;
Yesterday, we had a potential issue with the database view. When I tried to look into the dashboard, it kept giving me an error and said that the database view was unavailable. I pinged every device, and was able to remote into the logging device. I have notes from the previous TACACS admin, who advised that it is sometimes required to reinitialize the database view.
So, after running the patch to get into the Linux kernel on the 3415 logging server, I was preparing to launch the commands. But in his notes, he put " Soapbox" and made some side notes about doing this. He indicated that he would take the logger out of the environment, and put it as it's own primary instance first. Then, once it was working stablely, he would then re-initialize the database. Once done, he would re-add the device to the distributed environment. So:
I dont know if the screen shot uploaded. However, let me describe. When you go into System Admin>Operations>Distributed System Management, it shows you the primary instance, and the list of secondary instances below. I'm thinking that you put a check mark next to the device you want to remove, and click on the button "deregister". That "should" take it out of the distributed system. I'm guessing then that you can promote it to be it's own primary device. Then, log into it via CLI and re-initialize the database.
The main question I have is this: if I deregister it, does it fall off the list? Or does it get grayed out, so it can be put back into the distributed environment? I'd just had to deregister it and it fall off, and I dont have any of the settings or anything saved to put it back in.
Help appreciated :)

Unfortunately, database replication (trigger update) cannot be performed as it requires both the ACS boxes to run same code.
If you meant migration then yes that can be done.
Migrating from ACS 4.x to ACS 5.4
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/migrate.html
Jatin Katyal
- Do rate helpful posts -

SQL Database replication between Primary and DR site

Hi,
We are setting up a DR Site, for our Production SAP system.
At present the curren setup for Production SAP system are as follows.
SAP ERP 2005 (SAP ECC 6.), ABAP+JAVA on Windows with MS SQL Server
2005.
Data are stored on SAN and SAP installed on MSCS Cluster enviornment.
For Setting up the DR site, we are setting up Central System
installation and replication will be configured between SAP
Production/Primary system and DR site.
We are shoadwing at our test setup and facing below replication issues
while setting up transactional replication in MS SQL server 2005.
1. At present 78716 articles are available on Production Database, and
SQL fails the replication publication after 59000 articles.
We open the ticket with Microsoft and below are the suggestion provided
by them.
1. Microsfot suggest to prepare 2\3 publications for total number of
tables, 1 publication for all Views and 1 publication for SPs,
Functions and Data types with single Distributor Agent. Distribution Agent will
take care of propagating changes in the tables across the publications.
2. All related tables (Parent child relationship) to be published on
one publication.
3. It would recommend to create 4 publications: 2 for the tables, 1 for
the views and the other for the stored procedures. This would ensure
better manageability.
The main concerns here is about splitting the tables into two different
sets with about 30,000 in one of the publications and the rest in the
second publication.
You will have to make sure that all the dependant tables are included
in the same publication. Since this database is a SAP database, requesting to provide information as follows.
1. Identify and split the entire set of table into two/three groups.
2. How to publish dynamic tables (The tables which get created post
publication process).
Regards,
JP

Hi,
for database mirroring and log shipping there a several very good whitepapers and other documents out there:
[http://download.microsoft.com/download/d/9/4/d948f981-926e-40fa-a026-5bfcf076d9b9/SAP_SQL2005_Best%20Practices.doc]
[http://blogs.msdn.com/saponsqlserver/archive/2007/09/26/what-did-we-learn-using-database-mirroring-over-the-last-two-years-in-our-sap-erp-system-second-revision.aspx]
[http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032297524&EventCategory=5&culture=en-US&CountryCode=US]
[http://sqlcat.com/whitepapers/archive/2007/11/19/database-mirroring-best-practices-and-performance-considerations.aspx]
Furthermore see note 965908 for this.
The needed bandwidth depends on the amount of log you create in a given timeframe. Internet bandwidth can be suffient, if you don't generate much log (btw, i don't understand the term RTD is 220).
In the log shipping scenario you can run the DR site in standby mode, then a readonly access (as DBCC etc.) is possible.
Regards
Clas Hortien

ACS 4.2 Database replication issue

Similar Messages

Maybe you are looking for