Administration, User Accounts, Backup, and High Availability
Domain 8 is operational hygiene: who can log in and see what, how configuration and data survive a failure, and the conditions an HA pair must satisfy.
Users and authentication
- Local users live under Administration > Users and inherit permissions from user groups. Authorisation is per module (read versus read/write) and can be scoped by device group or site so a branch team sees only its own devices.
- External admin authentication can use RADIUS, TACACS+ or LDAP/AD, mapping returned groups to XIQ-SE user groups. Control's endpoint RADIUS service is separate and is not admin login.
- Enforce password policy and session timeout, and require named accounts for auditability.
Backup and restore
- Schedule full backups (database plus configuration) to local storage or FTP/SFTP, and verify them by restoring in a lab as well as reading the backup job log.
- Restore is version-sensitive: restore onto the same release, then upgrade. Licences bind to server identity, so a replacement host needs the licence re-hosted.
- Back up before every upgrade, licence change and major policy change, and keep a copy off the appliance.
High availability
- HA is an active/standby pair: same version, comparable sizing, same subnet/VLAN, a dedicated HA link, and a virtual IP that clients and devices use instead of physical addresses.
- Failover can be automatic on peer or heartbeat loss, or manual. The standby database stays in sync, so configuration needs no copy step. Test failover in a maintenance window.
Worked example
An HA pair is built with the primary on 24.2 and the standby on 23.7 "to upgrade later". HA will not form: versions must match exactly. Upgrade the standby to 24.2, let it synchronise, fail over, then upgrade the former primary. Clients must use the virtual IP, otherwise they pin to one node and see no benefit from failover.
Traps that cost marks
- Mismatched versions or sizing in an HA pair.
- Placing the HA link across a routed or NAT boundary.
- Restoring a backup onto a different release.
- Backups to a share with expired credentials failing silently.
- Granting global read/write when site scoping was intended.
- Assuming admin login and endpoint 802.1X share credentials.