Cisco Cisco Email Security Appliance C160 Mode D'Emploi

A. Creating a true “slave” machine is not possible with this architecture. However, you can disable 
the HTTP (GUI) and SSH/Telnet (CLI) access at the machine level. In this manner, a machine 
without GUI or CLI access only be configured by clusterconfig commands (that is, it can never be 
a login host). This is similar to having a slave, but the configuration can be defeated by turning on 
login access again. 

Q. Can I create multiple, segmented clusters?

A. Isolated “islands” of clusters are possible; in fact, there may be situations where creating them 
may be beneficial, for example, for performance reasons.

Q. I would like to reconfigure the IP address and hostname on one of my clustered appliances. If I do 
this, will I lose my GUI/CLI session before being able to run the reboot command?

Follow these steps:

Add the new IP address

Move the listener onto the new address 

Leave the cluster 

Change the hostname

Make sure that oldmachinename does not appear in the 

clusterconfig

 connections list when 

viewed from any machine

Make sure that all GUI sessions are logged out

Make sure that CCS is not enabled on any interface (check via 

interfaceconfig

 or Network > 

Listeners)

Add the machine back into the cluster

Q. Can the Destination Controls function be applied at the cluster level, or is it local machine level only?

It may be set at a cluster level; however, the limits are on a per-machine basis. So if you limit to 50 
connections, that is the limit set for each machine in the cluster.

Q. What can I do to maximize efficiency and minimize problems when setting up a cluster? 

Initial Planning

Try to configure as many things as possible at the cluster level.

Manage by machines only for the exceptions.

If you have multiple data centers, for example, use groups to share traits that are neither 
cluster-wide nor necessarily machine-specific.

Use the same name for Interfaces and Listeners on each of the appliances.

Be aware of restricted commands.

Pay attention to interdependencies among settings.

For example, the 

listenerconfig

 command (even at the cluster level) depends on interfaces that 

only exist at a machine level. If the interface does not exist at the machine level on all machines in 
the cluster, that listener will be disabled. 

Note that deleting an interface would also affect 

listenerconfig

.

 Pay attention to your settings!