11.2.2 Network Configuration Requirements
When you set up the L4 switch, the following configurations are required to route all Access Manager traffic through the L4 switch:
Switches: When you install an L4 switch, you can plug the machines directly into the L4 switch or plug them into an inner switch that is plugged into the L4 switch. When you use inner switches with an L4 switch, you must use at least two inner switches: one for Identity Servers and one for Access Gateways. Identity Server and Access Gateway cannot share the same inner switch. Such a configuration causes communication problems because Access Gateway and Identity Server try to establish direct communication with each other rather than routing all traffic through the L4 switch.
Network Routing Requirements: You need to analyze your routing configuration. Identity Servers and Access Gateways must be connected to separate ports in the L4 switch. If there is a connection in your network that allows an Identity Server or an Access Gateway to communicate directly with a client without going through the L4 switch, Access Gateway and Identity Server try to establish direct communication with the client because networking protocols are configured to select the most direct route. Such a configuration causes communication problems because all traffic must be routed through the L4 switch. Figure 11-4 illustrates this problem.
Figure 11-2 Network Configuration with a Potential Communication Problem
If your network allows for this type of communication, you need to block the communication channels illustrated with the dotted lines.
Figure 11-5 shows each cluster type with its own L2 switch. An Access Gateway cluster and an Identity Server cluster cannot share the same L2 switch because they can see the MAC address for each other. Networking protocols are configured to use the most direct route for the communication, and the MAC address is more direct than going up to the L4 switch and back down. Such a configuration causes communication problems because all traffic between the clusters need to be routed through the L4 switch. Using a separate L2 switch for each cluster type prevents them from gaining access to the MAC address and forces communication to take place through the L4 switch.