CCNA Multi Datacenter Federation Questions

The secondary datacenter must know which datacenter is the primary by setting primary_datacenter. Additionally, it needs a token with acl:read privileges in the primary to read ACL data. This token is configured using acl_replication_token. Both settings are required for ACL replication to function in a secondary datacenter.

The encrypt parameter specifies the gossip encryption key used for both LAN and WAN gossip. For a new datacenter to join the WAN federation, its servers must use the same gossip encryption key as the existing datacenter's WAN pool. Setting encrypt correctly is essential for secure and successful WAN gossip communication.

Consul's DNS interface supports cross-datacenter lookups by including the datacenter as a label before the domain. The format is <service>.service.<datacenter>.consul. Querying web.service.dc2.consul asks the local Consul agent to resolve the 'web' service in dc2 via the WAN federation, returning healthy instances from that remote catalog.

`consul members -wan` queries the WAN gossip pool directly, listing every datacenter's server agents with their gossip status and round-trip latency. That satisfies the stem's need for insight into WAN gossip state under high latency, unlike LAN-scoped commands or RPC-based tooling that bypass the gossip layer entirely.

The acl_replication_token is configured on the secondary datacenter's server agents, which use it to authenticate to the primary datacenter and receive replicated ACL data. Defining it there satisfies the requirement that secondary servers can pull token-protected ACL updates.

retry_join_wan specifies a list of WAN addresses of servers in other datacenters that the agent should attempt to join. Setting this in dc3 ensures that on startup or after a restart, the server will automatically attempt to join the WAN gossip pool, maintaining federation without manual intervention. This is the correct parameter for automatic WAN rejoin.

For ACL replication to work, the replication token must have 'acl:read' permissions on the primary datacenter. Without this, the secondary servers cannot read the ACL policies, tokens, and intentions from the primary, causing replication to fail. This is a common misconfiguration.

Mesh gateways route server-to-server RPC traffic between datacenters over the WAN, so datacenters without direct network connectivity can still federate. Each gateway proxies traffic on behalf of its local servers, satisfying the stem's no-shared-network constraint without requiring VPN tunnels or routed peering.

Non-primary datacenters do not originate ACL tokens or policies; they forward token writes to the primary and asynchronously replicate the resulting ACL state. This replication ensures consistent authorisation decisions locally, satisfying the requirement that servers in secondary datacenters enforce the same ACLs without holding the authoritative token store.

WAN federation relies on the gossip protocol, which exchanges lightweight heartbeat messages between servers in each datacentre. Sufficient bandwidth ensures these periodic probes and suspicion messages propagate reliably across the WAN, preventing false failure detection and maintaining a healthy federated membership.

Secondary datacentres keep serving their local workloads because each maintains its own replicated state, but ACL token and policy updates originate from the primary and cannot propagate. The outage therefore blocks only ACL changes, not ongoing operations.

Consul's DNS interface allows querying services in other datacenters by appending the datacenter name to the query, such as service.service.dc2.consul. This works out of the box once WAN federation is established. No additional configuration is needed beyond the initial federation. This is the standard way to perform cross-datacenter service discovery.

`consul members -wan` queries the WAN gossip pool, listing servers from every datacenter joined through the WAN federation. This directly satisfies the requirement to see the remote datacenter's server nodes, unlike the LAN pool, which only returns members of the local datacenter.

In a federated setup, the secondary datacenter maintains its own state and can continue to serve existing services using local data. Replicated ACLs and intentions are enforced based on the last successful replication. However, any changes to ACLs or intentions must be made in the primary, so new changes cannot be applied until the primary is back online.

Mesh gateways route service traffic through a shared gateway rather than exposing pod or node addresses, so datacentres with identical CIDR ranges never need direct IP reachability. This satisfies the stem's overlapping-IP constraint without renumbering either network.

Consul intentions define L4 authorisation rules that permit or deny connections between specific services, enforced via sidecar proxies or Connect. They restrict which local services may reach the remote datacenter services, satisfying the access-control requirement.

A secondary keeps its replicated ACL state and continues authorizing requests and answering catalog queries locally. What stops is the replication stream: any new token or policy must be created in the primary and cannot be propagated while it is offline, so ACL changes made in the secondary would not be authoritative or replicated.

When WAN traffic cannot route directly, Consul 1.15 supports WAN federation via mesh gateways. You set primary_gateways on the secondary servers to the primary's mesh gateway addresses and enable mesh gateways in both datacenters, allowing the secondary servers to establish the WAN gossip and RPC connections through the gateways.

Consul's gossip protocol uses the encryption key to authenticate and encrypt Serf messages; if the WAN key differs between datacenters, members cannot decrypt each other's traffic, so the join attempt fails rather than silently forming a split cluster.

Consul's gossip protocol and RPC compatibility depend on matching versions; mixed server versions across WAN-federated datacenters can break Serf membership and cause failed joins or inconsistent catalog replication. Uniform versions across every datacenter keep the WAN pool stable during and after the join.

'retry_join_wan' provides a list of WAN addresses that the server agent attempts to join, retrying indefinitely with backoff. It is the standard way to make WAN federation resilient across restarts, because the agent re-establishes the WAN gossip link automatically rather than requiring an operator to run 'consul join -wan' again.

ACL replication in Consul is asynchronous. Changes made in the primary datacenter are replicated to secondary datacenters on a periodic basis, so there can be a delay before the updated policy is visible. This scenario matches that behavior: the security engineer checked immediately, before the next replication cycle completed.

Inspecting server logs surfaces RPC errors that reveal failed cross-datacenter RPCs, directly satisfying the need to diagnose inter-datacenter communication faults. Consul's server-to-server RPC traffic carries replication and forwarding requests, so logged RPC failures pinpoint connectivity or TLS problems between datacenters.

The datacenter field labels which Consul datacenter an agent belongs to, letting servers, services and queries be scoped to that logical segment. Agents in different datacenters form separate clusters joined only through WAN gossip, enabling multi-region segmentation.

The -wan flag directs the join request over the WAN gossip pool rather than the LAN pool, which is the only way to federate separate Consul datacenters. Running consul join without -wan would attempt a LAN gossip join and fail to establish cross-datacenter federation.

retry_join_wan specifies one or more addresses of existing Consul servers in the WAN gossip pool. It allows the new datacenter's servers to automatically join the WAN pool and retry if the initial join fails. Without it, the servers would not know how to reach the existing WAN cluster, and manual joining would be required. This is essential for multi-datacenter federation.

By default, Consul DNS queries resolve services in the local datacenter. To query a service in another datacenter, you must include the datacenter name in the query, such as web.service.dc2.consul. Without the datacenter qualifier, the query only searches the local datacenter's catalog, which may not contain the service, resulting in no results.

The 'No known leader' status in ACL replication typically means the secondary datacenter cannot reach the primary datacenter's servers to determine the leader. This can be caused by a network partition, firewall rules blocking WAN traffic, or WAN gossip not functioning. Without connectivity to the primary, replication cannot proceed, leading to this status.

ACL replication in Consul propagates token and policy changes from the primary to secondary datacenters asynchronously, satisfying the stem's cross-datacenter consistency requirement without blocking primary writes. Secondaries receive updates shortly after the primary commits them, so the change is not instantaneous but eventually consistent across all secondary datacenters.

Once ACL data is replicated to secondary datacenters, it is stored locally. During a primary outage, secondary datacenters can continue to use the replicated tokens and policies for local authorization decisions. This allows services to authenticate and authorize without requiring the primary to be online, which is a key benefit of ACL replication.

The failover block in a prepared query allows you to define a prioritized list of datacenters. When the local datacenter lacks healthy instances, Consul queries the specified datacenters in order and returns results from the first one with healthy instances. This enables controlled cross-datacenter failover.

ACL replication requires a token that exists in the primary datacenter and has read access to ACL policies, tokens, and roles. After rotating the token in dc1, the old token is invalid, causing permission denied in dc2. Creating a new token in dc1 with appropriate read permissions and updating dc2's configuration resolves the issue. The token must be from the primary, not the secondary.

Consul accepts configuration in either HCL or JSON, satisfying the stem's requirement for the supported file format. HCL provides comments and a more readable syntax, while JSON suits machine-generated files; both are parsed natively by the Consul agent for service definitions, checks and agent settings.

In a prepared query, the `Failover` block allows you to specify a list of datacenters to try if the local datacenter's service instances are unhealthy. Setting `Datacenters` to `["dc2"]` will cause the query to failover to dc2 when no healthy instances are available in the local datacenter. This is the correct configuration for automatic cross-datacenter failover.

Every Consul datacenter requires its own server cluster to maintain the Raft quorum and manage the catalogue, intentions and ACLs; a datacenter cannot function with client agents alone. This satisfies the stem's requirement that each datacenter operates independently, with servers in one datacenter not replicating data to servers in another.

The /v1/health/service endpoint returns health checks for a given service. The dc query parameter specifies the target datacenter. Since dc1 and dc2 are federated, a request to the local agent in dc1 with dc=dc2 will be forwarded to dc2's servers and return the health information for 'web' in dc2. This is the correct way to query remote datacenter health via the HTTP API.

The `failover` block within `prepared_queries` accepts a `targets` list naming datacenters in priority order, so Consul attempts service resolution against each in turn when the local datacenter's instances are unreachable. This satisfies the cross-datacenter failover constraint by defining exactly which remote datacenters to query.

Consul's KV store is scoped per datacenter; entries written in one datacenter are not replicated to peers. Cross-datacenter inconsistency is therefore expected behaviour, not replication failure, because each datacenter maintains its own independent KV namespace.

Consul's DNS interface natively understands the '.dcX.consul' suffix. When a local agent receives a query for a service in a remote datacenter, it forwards the request to that datacenter's servers across the WAN gossip and RPC federation link, so no extra components or manual forwarding rules are required once servers are joined.

Consul-template watches the Consul catalog and KV store, then renders templates into local configuration files and reloads dependent services. Across datacenters it queries the relevant Consul servers, so the stem's requirement for generating configuration from Consul data is met directly.

Three servers allow the Raft consensus quorum of two to survive a single node failure while still electing a leader, giving high availability without the write-latency penalty that five or more servers introduce in one datacenter.

Consul servers use the Serf library, which implements the SWIM gossip protocol, to exchange membership and failure-detection messages across the WAN gossip pool. SWIM's infection-style dissemination lets datacentre servers converge on membership state without a central coordinator.

`retry_join_wan` is specifically designed to provide addresses of servers in other datacenters to join the WAN gossip pool. When set, the agent will attempt to join the WAN gossip pool using the provided addresses. This is the correct way to federate a new datacenter with existing ones. It is commonly used in multi-datacenter deployments to automate WAN joining.

The WAN gossip pool contains only Consul server nodes, one per datacentre, which exchange membership and datacentre information across the federation. Clients join only the LAN pool, so this statement accurately describes WAN gossip behaviour.

ACL replication requires the secondary datacenter to authenticate to the primary using a token with replication permissions. If acl_replication_token is missing, expired, or lacks the necessary policies, the secondary cannot pull token and policy updates. As a result, tokens created in the primary will not be replicated, and the secondary will not recognize them for authorization.