Concept design assistance.

lcsw2013

Hi,

We are in process of re-designing our environment. We are putting together different designs and POC's to test and see which design we will ultimately take and deploy but there has been some questions asked that we have been unable to get any solid answers on. Documentation is all over the place and support hasn't given us an concrete answers. So I wanted to ask on here and hopefully get answers from solarwinds product managers and or administrators who have experienced the same and might be able to provide some insights.

1. We want to setup SSO. Since we are federal and use id cards we need to know how we can incorporate that system into solarwinds so we can use our cards to login. SAML is something we looked at but support said that there wasn't anyway for solarwinds to integrate or it was supported? I'm not convinced that this is the case.

Has anyone worked in a federal environment and gotten solarwinds integrated with the id card system for SSO?

2. We are developing many different ways to deploy HA. I've read that solarwinds supports SQL AG and Alwayson feature. However, documentation says config wizard is needed when there is a database fail over? Or does the software automatically resync. What's the best way to set it up so that there is minimal manual intervention.

3. We are in-between a design that incorporates 3 separate environments with EOC and an ha environment. The biggest question that came up is if a data center has network failure but technically is still up how can you continue to monitor it without losing metrics? Because if it fails outside of the center in an HA setup the outside solarwinds server would not get metrics for devices inside. But then again EOC is not really HA either. We want to incorporate a design that's HA but without the lose of metrics within datacenters that might have network failure but are technically still up and running.

I'll start with these three questions and request for suggestions. Basically we are trying to see the capability of the software possibly even coupled with customizations that could accomplish what we are looking for. And we wanted to know my a design or two suggestions that might not of come up to mind in our meetings. Some times an outsider perspective can help us see what we can't see so to speak.

Thanks!

Find more posts tagged with

design

Accepted answers

All comments

lcsw2013

aLTeReGo adatole

Guys can you possibly provide some insight and help please? If not direct me to the right product manager whom we could get some solid answers from? We are kind of bumping up against some dead lines and need solid answers we haven't been able to find. Any help is greatly appreciated. Thanks!

aLTeReGo

lcsw2013 wrote:
1. We want to setup SSO. Since we are federal and use id cards we need to know how we can incorporate that system into solarwinds so we can use our cards to login. SAML is something we looked at but support said that there wasn't anyway for solarwinds to integrate or it was supported? I'm not convinced that this is the case.

SAML authentication support was added in Orion Platform 2018.4, with NPM 12.4. > Release Notes for NPM

Has anyone worked in a federal environment and gotten solarwinds integrated with the id card system for SSO?

Most federal organizations utilize CAC cards to authentication to Orion

2. We are developing many different ways to deploy HA. I've read that solarwinds supports SQL AG and Alwayson feature. However, documentation says config wizard is needed when there is a database fail over? Or does the software automatically resync. What's the best way to set it up so that there is minimal manual intervention.

Native SQL AlwaysOn Availablity Group support was added in Orion Platform 2017.3 and is the only method supported for use with Orion High Availability in a multi-subnet failover configuration. Database Failover is automatic and there is no requirement to re-run the Configuration Wizard.

3. We are in-between a design that incorporates 3 separate environments with EOC and an ha environment. The biggest question that came up is if a data center has network failure but technically is still up how can you continue to monitor it without losing metrics? Because if it fails outside of the center in an HA setup the outside solarwinds server would not get metrics for devices inside. But then again EOC is not really HA either. We want to incorporate a design that's HA but without the lose of metrics within datacenters that might have network failure but are technically still up and running.

It sounds like you're looking for Disaster Recovery, where one poller resides in the data center and the other in a different data center. When/if network connectivity is lost, that poller will continue to poll and store its data in MSMQ. When connectivity is restored, the queue will empty into the SQL database the next time it becomes the active member of the pool. For this reason you have the ability to define a 'Prefered' member in a pool that will always be the 'Active' member if it's available.

lcsw2013

Super helpful information! Thank you so much. If you don't mind I wanted to dig a little deeper in a few of your answers to get more information.

1. SAML and CAC integration is basically what we where looking for. But the team was in touch with support and support was unable to properly tell our guys how to set this up. We use pingfederate here (I believe this is what it's called). And everything we do we use a card to authenticate. There has been a few proof of concept done with sales engineers where the desired results where not achieved. I was told that either the integration with solarwinds did not happen properly. Or if the integration was there for some reason attempting to use our cards where resulting in errors and not working properly.

After several go's with support I guess someone told them that what we where trying to do is not supported? This was the confusing part to me. But I just wanted to ask for a little more information regarding this answer if you have more to provide.

(I'll also pour through the documents you had provided as well)

2. It's good to hear that it's automatic. But in my professional experience having worked with several environments in the past I had seen instances where for some reason or another solarwinds did not reconnect to the database even though everything was setup properly. Investigation was inconclusive as to what happened. But I guess I wanted to know if cases like this are one off or rare instances?

3. I was unaware of this. So in the pool you can identify one member to basically be always on? So for instance you have DC A and DC B. The main router on DC A fails but the environment is still up. The fail over would go to DC B and when router on DC a is fixed the information polled from DC A would be automatically dumped into the database correct?

Much appreciated. This helps greatly!

lcsw2013

My team asked me to send you a big thanks. let me know if you have the additional information i requested. if not i think we can use the initial information sent. i opened this thread because we urgently needed this help.

lcsw2013

sander_franken

lcsw2013 wrote:
3. I was unaware of this. So in the pool you can identify one member to basically be always on? So for instance you have DC A and DC B. The main router on DC A fails but the environment is still up. The fail over would go to DC B and when router on DC a is fixed the information polled from DC A would be automatically dumped into the database correct?

In our case we define our Main Poller as 'Prefered' member. When it goes down, fail-over happens to the Standby. When the Main Poller comes back up again, the system fails back over to that server because of its 'Prefered' status.

AFAIK, any polling engine that loses connection to the database but is still polling will build up a queue that will be dumped into the database when connection is restored.

aLTeReGo

lcsw2013 wrote:

1. SAML and CAC integration is basically what we where looking for. But the team was in touch with support and support was unable to properly tell our guys how to set this up. We use pingfederate here (I believe this is what it's called). And everything we do we use a card to authenticate. There has been a few proof of concept done with sales engineers where the desired results where not achieved. I was told that either the integration with solarwinds did not happen properly. Or if the integration was there for some reason attempting to use our cards where resulting in errors and not working properly.
After several go's with support I guess someone told them that what we where trying to do is not supported? This was the confusing part to me. But I just wanted to ask for a little more information regarding this answer if you have more to provide.
(I'll also pour through the documents you had provided as well)

SAML 2.0 is an open standard, so in theory, any standard SAML 2.0 provider should work with Orion. Unfortunately, there are far too many SAML providers that it's not possible for us to test, document, and train support staff on. We do provide documentation and official support for Okta and ADFS, but there have been many other customers successfully using other SAML providers such as G-suite and Shibboleth with Orion.

2. It's good to hear that it's automatic. But in my professional experience having worked with several environments in the past I had seen instances where for some reason or another solarwinds did not reconnect to the database even though everything was setup properly. Investigation was inconclusive as to what happened. But I guess I wanted to know if cases like this are one off or rare instances?

Monitoring Orion's ability to connect to the database is actually one of the health checks performed by Orion HA. This includes local recovery to limit unnecessary failovers. Only in the event that the server is unable to recover locally by reconnecting to the database would failover to the other member occur.

3. I was unaware of this. So in the pool you can identify one member to basically be always on? So for instance you have DC A and DC B. The main router on DC A fails but the environment is still up. The fail over would go to DC B and when router on DC a is fixed the information polled from DC A would be automatically dumped into the database correct?

Provided the member at DCA was the 'preferred' member.

lcsw2013

This is amazing. Having fallen behind just a tad bit due to other things and solarwinds aggressively releasing new features means I was unaware about several of these features. And apparently need to do some homework on to catch back up.

This answers plenty and gives me a general idea of where I should take our design and deployment for our new POC. I'm sure I still have a few more questions here and I'll post them. but for now thanks to all! this is greatly appreciated.

lcsw2013

As expected a few new questions came up as meetings have taken place and the initial deployment design is maturing into something that's more ready for a POC.

We have 3 DC's. DC 1, DC 2, DC 3 (Cloud). We have the primary on DC 2. APE's across all three DC's. Wed servers on 2 DC's, etc.

Here is a question that came. We plan to design our HA in pools. So one Primary server to one secondary server (Active/passive) in a multi-subnet environment. One primary APE to one secondary APE and so one.

Will the HA side of solarwinds support multiple separate pools of servers? Because technically speaking we can't do one to one when we have three DC's. But we figured this. If the software allows separate pools all we have to do is create separate instances in the cloud DC and match them with dc 2 pool and dc 1 pool and have a complete HA environment. (If there is a better way to put this together that we might not be seeing please let us know). But this is the way we brain stormed it.

so Primary has it's pool.

APE's have a pool for one dc and another pool for the other dc and they all fail to the cloud. Essentially what we want is for example if the primary doesn't fail over but a APE does can it fail over on it's own? Independent fail overs? Or is that considered a limitation of the software at this point?

We are almost making an attempt to have a semi autonomous system that can almost take care of it's self with minimal intervention. But we understand our reach may potentially be going above what solarwinds can do that's we are posing the question here.

If our design is feasible and seems sound lets us know. We'll go ahead with our plans to setup a POC and test it out. But if we are running against limitations suggestions are welcomed.

aLTeReGo I'm not sure if it's entirely understandable what our end goal is but we are also exploring all that the software has to offer. We want to take full advantage of the HA capabilities to design something that won't let us down. Our problem is 3 separate datacenters. If the HA solution supports independent pools great! if not, this will be interesting.

Looking forward to your advice sir! Thanks again for your help! it's been a tremendous push to help us in presenting something complete and solid within our deadlines.

aLTeReGo

Each HA pool consists of two servers. An active and standby. You can have as many pools as you have Pollers, and each pool can be configured independently of the others.

lcsw2013

You have no idea how much this is helping us! Big thank you! I'll continue to keep this opened a little longer just in case more questions come in.

We appreciate you helping us out!