3 nodes SPP cluster linked to distinct 2 nodes SPS clusters

Hi Simone,

I have not seen this configuration in production so far but I believe that you should be able to join multiple SPS clusters to an existing SPP cluster.

Please test and update if any issues?

Thanks!

Hi Tawfiq,

How to configure 2 SPS cluster nodes to ensure HA by editing cluster management ?

Nodes are virtual and do not support HA by default, and changing managed network configuration only allow load balancing over the nodes.

Hi Mahmoud,

HA mode is supported with SPS hardware appliances only (where one node replicates disk data to the secondary).

- Installing two SPS hardware appliances in HA mode can be found in the installation guide here:

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/7.4/installation-guide/2#TOPIC-2065319

The other type of SPS cluster is known as Configuration synchronization cluster (this supports either hardware or virtual SPS appliances) where configuration is fetched by Managed host nodes from a Central Management node:

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/7.4/administration-guide/45#TOPIC-2065566

Thanks!

Hello Tawfiq,

I'm seeking for your confirmation regarding SPS cluster functions.

In case the cluster has two nodes (1 primary and 1 managed), what is the normal behavior in case the primary node is down? Do the SPP initiated sessions could be connected?

As per the (Scalability and High Availability in Safeguard) document - Failure of the configuration primary in a scalability cluster:

the initiated connections should work normally on managed nodes in case the primary is down

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/7.5.1/scalability-and-high-availability-in-safeguard/4#TOPIC-2250780

We have tried a scenario where SPS central node is off, where the connection is SPP initiated, but unfortunately the connection could not be started.

After checking the connected session appliances in cluster portal, we found that SPP couldn’t connect to SPS cluster generally.

where it succeeded in case the managed node is down and central node is up.

thanks in advance, 

Did both SPS nodes use Search Local?

or Did you have one as Search Master and another Search Minion?

If a node has Search Master role, then this role cannot be used for session proxy.

If both are search local then I would expect sessions to work from either SPS node if other was offline

Thanks!

Dear Tawfiq,

SPP communicates with the Central SPS node. It is this SPS node that provides all information regarding the other nodes.
If that node goes down then the SPP cannot verify information regarding any other node and it will be unable to select the correct one.
So how can it redirects connection to the managed host if the central is down?

Hi,

SPP will still be able to route connections to  (None Search Master) Managed Hosts using last known configuration.

When Central Management node is down, no new changes can be fetched by SPP from the SPS cluster side but traffic flow will continue to (None Search Master) managed host nodes if these nodes are still up and running. 

Thanks!

Hi,

SPP will still be able to route connections to  (None Search Master) Managed Hosts using last known configuration.

When Central Management node is down, no new changes can be fetched by SPP from the SPS cluster side but traffic flow will continue to (None Search Master) managed host nodes if these nodes are still up and running. 

Thanks!