Physical locations of primary and replica instances

[BillHagen]

Page 118 of the RSA Authentication Manager 8.1 Administrator's Guide shows the following graphic:

I would like to install the Authentication Manager Primary Instance and LDAP Directory Server 1 in the Headquarters building, and the Secondary Instance and LDAP Directory Server 2 in the DR building, physically and geographically separated...then make the above connections.

Does this work? Does it make sense? I'm scared senseless that all of IT will be using a passcode with key fobs, and then AD turns to mush...and we can't get logged in to fix it. I'm hoping the above scenario will fix that?

Thoughts?

[JayGuillette]

Both the Primary and the Replica need access to an LDAP external Identity Source like AD, so if they have local access, performance and reliability should be better.  Something like this, basic but local.

[JayGuillette]

Both the Primary and the Replica need access to an LDAP external Identity Source like AD, so if they have local access, performance and reliability should be better.  Something like this, basic but local.

[BillHagen]

Thanks for the PPT, that actually answered some other questions I had.

As for this specific question, it seems we're on the same page:

Correct? Primary instance pointing to local AD/LDAPS with offisite AD/LDAPS as failover, and offsite Replica pointing to offsite AD/LDAPS (that's on the same LAN) with offiste AD/LDAPS as failover.

Primary: onsite. Replica: offsite. Acceptable?

[JayGuillette · Accepted solution]

Yes, we're on same page.  Normally you want to go local for information requests whenever possible in your network design, so it makes sense for a replica at a separate Replica site to be configured to ask the local replica site Domain Controller for User info, instead of have the same configuration of the Primary.  I've seen more than a few sites where copying the Primary configuration to the replica slows things down and causes problems, because the Replica at a different location is configured to first go to the Domain Controller next to the Primary, across a WAN.

[BillHagen]

Thanks Jay; this gives me confidence to go ahead with my install as planned.