How do AGS sessions and settings behave in a cluster?

Short answer

AGS settings are part of the Load Balancer configuration: providers, authentication servers, local databases and accounts, MFA profiles, protection policies and the AGS settings of the vServices are sent to the peer device with the default auto-sync; if Manual Sync Mode is on, they are sent manually with Synchronize. The password reset and change operations that Local Database users perform from the access pages are forwarded to the peer device immediately. Sessions, failed attempt counters and locks, and TOTP records, on the other hand, are runtime records; they are kept in each device's own AGS store and are not included in the configuration synchronization. The Sessions, Lockout and TOTP tabs show the records of the two devices in a single list; the delete and reset operations on these tabs are sent to both devices together.

How Does It Work?

Data	Where it is kept	How it passes to the peer device
AGS profiles and the AGS settings of the vServices	Configuration	With the Load Balancer configuration: auto-sync, or Synchronize in Manual Sync Mode
Local Database accounts	Configuration	Administrator changes with the configuration; the user's own password reset and change operations immediately
AGS sessions, failed attempt counters and locks, TOTP records	Each device's own AGS store	Not included in the configuration synchronization

The monitoring tabs read from each device separately and combine the result:

• Sessions: The sessions of the two devices appear in a single list; Revoke Session(s) is sent to both devices together. Limit is applied to each device separately.
• Lockout: Clear Lockouts and Reset Failures are sent to both devices together.
• TOTP: Reset TOTP deletes the user's record on both devices together.

Cluster Settings in TR7

The synchronization behavior is determined on the Settings → Device Management → HA Clustering & Sync screen (HA Clustering & Sync). A change made on the AGS screens is applied like other Load Balancer changes and goes to the peer device the same way. The state, memory and storage usage of the AGS access engine are monitored on the vService's Engine tab (What is the AGS engine; what does the Engine screen show?).

Common Misconceptions

• "To remove a user's lock, each of the two devices is logged into separately." The operations on the Lockout tab are sent to both devices together; they are performed from a single screen.
• "The count in the Sessions list covers the sessions of a single device." The list combines the sessions of the two devices; which device a row comes from is not shown in the table.
• "In Manual Sync Mode, an AGS setting passes to the peer device immediately." While Manual Sync Mode is on, AGS profiles and vService settings, too, do not pass to the peer device until they are sent with Synchronize; the user's own password operations are outside this rule.

How it is done in the documentation

• HA Clustering & Sync · Manual Sync Mode
• Sessions · Scope and Limits
• Lockout · Scope and Limits
• TOTP · Scope and Limits

Related questions

• How is an AGS session kept; what does the Sessions screen show?
• What is an Account Lockout Policy; how does account lockout work?
• How does MFA work in AGS; which methods are available?
• What is Local Database; when does it make sense to keep users in TR7?