JMS and loadbalanced Radius servers

Question

I have a problem with sending JMS messages to a queue where they get picked up and implemented upon by executing cisco cmds via ssh, i seem to get varied JMS commnds sent to two different VPNs.
there are two cisco swithes and two jboss appserevers, each having a radius serever to authenticate the remote ip address and then assign some firewall rules to the cisco kits via the JMS service , which are just cisco cmd via ssh or some type of secure telnet - put problem is that instaed of the same rule-set being applied to both the cisco swithes i get varaition in the firewall rules being sent to the swithes - sometime i get half sent to one swith and rest to the other , what should i be looking at to isolate the problem the logs dont show much , i have radius server logs and server logs and firewall logs - but cant see what the problem is where could someone suggest i look to start figuring out what the problem is - is it something to do with the load balancing , the JMS stuff - if so what should i look at or the ssh type telnet session from Java - is there known unreliabilty type issues with regards to transactions when executing cmd line stuff via a secure telnet session from a java object. Or does any one know of any other firewall manager type utility that can be integrated with a radius server and java application inoder to dynamically set up a firewall congiguration of cisco kit

Answer 1

The service is via a topic as a destination .....
the basic idea of the functionality is as follows ...i'm hoping some one can clearly spot what the issue would be such as known issues with excuting IOS cmds via ...CiscoController object which knows how to use SSH-2 protocol to send IOS commands.
the basic idea of functionality is as follows:-
The network elements themselves are protected against intrusion by using standard Cisco firewall technologies. A PIX 515e redundant pair is employed to protect each of the Access Points and the Control and Monitoring platform.
The Dynamic Firewall works in conjunction with the RADIUS server to dynamically apply access list entries to the interface of the VPN routers in the Access Point.
Address Assignment
The RADIUS Server is responsible for assigning an IP address to a terminal, once it has requested access to the network. Session notifications, which include the assigned ip address and firewall rules, are communicated via a JMS Topic called �xxxxxSessionTopic� The firewall manager listens for these notifications and uses them to dynamically add access list entries to the vpn router. When a session is closed, i.e. when a terminal detaches from the network, another notification is broadcast as such. This is used to remove the access list entries from the router.
It is important to ensure that the correct access list entries are added and removed when updating the router. Newer versions of Cisco IOS allow serial numbers to be employed when applying access list entries, thus negating the necessity to remove and re-apply all entries to ensure that they retain the same order. The firewall manager there makes use of the value of the id field for the Address object allocated to the terminal as a basis for generating the unique serial number. This is multiplied by 20 and the rule priority number in the FirewallRule object is added to make the serial number unique, as the ip address is a unique entity on the platform. This makes management of the access list entries relatively simple.
Connectivity
In order to ensure access to the VPN routers remains secure, SSH-2 is used by the Dynamic Firewall software to connect to the VPN routers and deliver the necessary IOS commands to insert new rules into the access list. The necessary access details are started in the SAR files that package the code and are located in the JBoss hot deploy directory on the application servers.
Software Objects
The Dynamic firewall components are packaged in a file named xxxxFirewallManager.sar. This is a JBoss service archive and is started on deployment of the SAR file to the jboss hot deploy directory, or on start up of the JBoss application server. The archive contains the java objects listed below, which are responsible for the implementation of the Dynamic Firewall, along with necessary configuration files.
FirewallManagerMBean
This is a JBoss JMX Service object that is registered onto the JBoss JMX bus. Two of these objects will be configured for each Router firewall that is to be managed by the application server. The object has a number of properties that must be initialised through the jboss-service.xml file that is stored in the SAR file. These properties are listed in the following table. See the example jboss-service.xml file in the configuration section.
FirewallManager
Each MBean creates a FirewallManager. The FirewallManager is responsible for receiving session creation and deletion notification messages over the JMS Topic �xxxxxSessionTopic�. It then un-marshals a FirewallRuleSet object containing the rules (up to 20) that must be applied to the access list. A FirewallController is then used to deliver these rules to the router
FirewallController
This specialises a CiscoController object which knows how to use SSH-2 protocol to send IOS commands.
Configuration
Configuration is located in the root directory of the SAR. One jboss-service.xml file must exist and a separate properties file will exist for each of the router access lists that are managed (normally 2 per router)
the problem is that even with this sound architecure it seems that the firewall rules are not correctly and equally applied to both the routers.
it may be a transactional issue where the messages have to be set inside a transaction - but can somebody please shed some light on this issue so that i'm not blindly going down different paths. does any one know of any way to easliy set up a dynamic firewall list and apply that to cisco kit? via a java app