> For the complete documentation index, see [llms.txt](https://docs.parallels.com/landing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.parallels.com/landing/ras-admin-guide/parallels-ras-21-administrators-guide/ras-connection-broker/secondary-connection-brokers.md).

# Secondary Connection Brokers

A secondary Connection Broker is added to a Site to provide redundancy and distribute runtime workloads. Connection Brokers within a Site can operate simultaneously in an active/active configuration. This allows multiple Connection Brokers to actively process runtime workloads and monitor the environment.

If a Connection Broker becomes unavailable, the remaining active Connection Brokers can continue to handle the workload. The Connection Broker architecture reduces downtime and prevents the Primary Connection Broker from becoming a bottleneck.

When you install one or more Secondary Connection Brokers, runtime information is replicated between the Connection Brokers and the agents they manage. In addition, active Connection Brokers can handle authentication.

The Primary Connection Broker performs the same runtime tasks as Secondary Connection Brokers, but has additional responsibilities. It manages system-wide processes and settings that a single Connection Broker must manage.

Connection Brokers within a Site can have one of the following roles:

* **Primary Connection Broker** — manages system-wide settings and processes and also participates in runtime monitoring and workload processing.
* **Secondary Connection Broker** — actively processes runtime workloads, monitors resources, and provides redundancy for the Primary Connection Broker.
* **Connection Broker in standby** — maintains replicated configuration but does not actively process runtime workloads.
* **Connection Broker in a Tenant Broker environment** — provides Connection Broker functionality for a tenant environment and performs a defined subset of Connection Broker operations.

### Connection Broker roles and responsibilities

The following table describes Connection Broker responsibilities by role.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Process</th><th>Primary Connection Broker</th><th>Secondary Connection Broker</th><th>Connection Broker in Standby</th><th>Connection Broker in a Tenant Broker environment</th></tr></thead><tbody><tr><td>Handles administration sessions</td><td>Yes, Primary Site only</td><td>No</td><td>No</td><td>Yes</td></tr><tr><td>Manages system settings</td><td>Yes</td><td>No</td><td>No</td><td>Yes</td></tr><tr><td>Replicates RAS settings changes</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Keeps RAS settings change audit</td><td>Yes</td><td>Optional</td><td>Optional</td><td>Yes</td></tr><tr><td>Monitors Connection Broker performance counters</td><td>Yes</td><td>Yes</td><td>No</td><td>Yes</td></tr><tr><td>Monitors RDSH performance counters</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Monitors VDI Host performance counters</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Monitors SGW performance counters</td><td>Yes</td><td>Yes</td><td>No</td><td>Yes</td></tr><tr><td>Monitors ES performance counters</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Monitors runtime sessions</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Monitors runtime applications/processes</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Monitors VDI sessions and reconnections</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Sends licensing information and heartbeat</td><td>Yes</td><td>No. Provides information to the Primary Connection Broker only</td><td>No</td><td>No</td></tr><tr><td>Processes and sends CEP information</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Sends information to the Reporting Server</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Manages Schedulers</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Provides information to the Reporting Engine</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Device Manager shadowing</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Sends system alert email notifications</td><td>Yes</td><td>Yes</td><td>No</td><td>Yes</td></tr><tr><td>TOTP registration</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Email OTP registration</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Manages template versioning and distribution</td><td>Yes. During setup, the Primary Site Connection Broker is used</td><td>Yes. During setup, the Primary Site Connection Broker is used</td><td>No</td><td>No</td></tr><tr><td>Clones hosts from templates</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Manages auto scaling</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr><tr><td>Manages Web authentication</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Manages Credentials authentication</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Manages Smart card authentication</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Validates Policies</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Provides configuration to HALB devices</td><td>Yes. The first Connection Broker to reach the device provides the settings</td><td>Yes. The first Connection Broker to reach the device provides the settings</td><td>No</td><td>Yes. The first Connection Broker to reach the device provides the settings</td></tr><tr><td>Distributes configuration changes to RDSH, VDI, PC, ES, and Gateway agents</td><td>Yes</td><td>Yes</td><td>No</td><td>Yes. HALB and Gateway agents only</td></tr></tbody></table>

#### Primary Connection Broker

The Primary Connection Broker handles system-wide operations that must be managed by a single Connection Broker.

These operations include managing system settings, schedulers, auto scaling, licensing information, CEP information, reporting, and other Site-level functions.

The Primary Connection Broker also participates in runtime monitoring and workload processing. However, because it has additional responsibilities, the system does not distribute agent connections equally between the Primary Connection Broker and Secondary Connection Brokers.

#### Secondary Connection Brokers

Secondary Connection Brokers are active Connection Brokers. They are not passive backup servers.

A Secondary Connection Broker can actively:

* Monitor Connection Broker, RDSH, VDI, SGW, and ES performance counters.
* Monitor runtime sessions and applications/processes.
* Monitor VDI sessions and reconnections.
* Replicate RAS settings changes.
* Participate in Web, Credentials, and Smart Card authentication.
* Perform TOTP and Email OTP registration.
* Validate policies.
* Provide configuration to HALB devices.
* Distribute configuration changes to supported agents.
* Send system alert email notifications.

Secondary Connection Brokers do not manage system settings or the Site-wide processes reserved for the Primary Connection Broker.

A Secondary Connection Broker also does not directly perform the Primary Connection Broker's licensing, CEP, reporting, scheduling, auto scaling, or Device Manager shadowing functions.

#### Connection Broker in standby

A standby Connection Broker does not actively process runtime workloads.

A standby Connection Broker replicates RAS settings changes but does not perform active runtime monitoring, handle administration sessions, manage system settings, or process runtime sessions and applications.

Standby Connection Brokers are useful when you need an additional Connection Broker for availability without having that Connection Broker participate in the active runtime workload.

#### Connection Broker in a Tenant Broker environment

A Connection Broker in a Tenant Broker environment performs a different set of functions from a Primary or Secondary Connection Broker in the primary Site.

A Tenant Broker Connection Broker can:

* Handle administration sessions.
* Manage system settings.
* Replicate RAS settings changes.
* Maintain the RAS settings change audit.
* Monitor Connection Broker performance counters.
* Monitor SGW performance counters.
* Send system alert email notifications.
* Provide configuration to HALB devices.
* Distribute configuration changes to HALB and Gateway agents.

It does not perform the primary Site's reporting, scheduling, auto-scaling, licensing, or runtime session monitoring functions.

### Agent connection distribution

Because the Primary Connection Broker performs additional system-wide functions, agent connections are not distributed equally between Connection Brokers.

The system uses the following preferred distribution:

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Number of Connection Brokers</th><th>Primary Connection Broker agent connections</th><th>Secondary Connection Broker agent connections</th></tr></thead><tbody><tr><td>1</td><td>100%</td><td>—</td></tr><tr><td>2</td><td>40%</td><td>60%</td></tr><tr><td>3</td><td>20%</td><td>40% each</td></tr><tr><td>4</td><td>10%</td><td>30% each</td></tr><tr><td>5 or more</td><td>0%</td><td>100 / number of Secondary Connection Brokers</td></tr></tbody></table>

This distribution is intentional. It reduces the workload placed on the Primary Connection Broker so that it has sufficient resources to perform its additional system-wide responsibilities.

For five or more Connection Brokers, the Primary Connection Broker does not receive a preferred share of agent connections. Agent connections are distributed between the Secondary Connection Brokers.

The percentages represent the preferred distribution of agent connections. They do not mean that all Connection Brokers perform the same functions or that every type of runtime workload is distributed equally.

#### Preferred Connection Broker

If an agent is explicitly configured to be managed by a specific Connection Broker, that Connection Broker is preferred over the general connection distribution.

This allows an administrator to control the preferred Connection Broker for a particular agent when required.

For example, if an RDSH agent is configured to use CB2 as its preferred Connection Broker, CB2 is preferred even if the general Site distribution would otherwise assign the agent to another Connection Broker.

### Planning for secondary Connection Brokers

RAS Connection Brokers running in the same Site communicate with each other and participate in workload processing. Connection Brokers and agents can exchange a significant amount of data, so provide reliable, high-speed network connectivity.

When planning a Site with multiple Connection Brokers, consider the following:

* Provide reliable, high-speed connectivity between Connection Brokers.
* Ensure that the network infrastructure can support the communication and configuration replication generated by multiple Connection Brokers.
* Where appropriate, use a dedicated subnetwork for Connection Broker communication.
* Make sure Connection Brokers can communicate with agents and other RAS components over the required network paths.
* Connection Brokers use TCP port 20030 to communicate with each other.
* When determining the number of active Secondary Connection Brokers, consider the additional workload performed by the Primary Connection Broker.
* Use the preferred agent connection distribution described above to reduce the load on the Primary Connection Broker.
* Use standby Connection Brokers when you need additional availability without adding another active runtime processor.

The active Connection Broker architecture supports multiple Connection Brokers in the same Site. However, adding Connection Brokers also increases configuration replication and inter-Connection-Broker communication. Therefore, select the number of Connection Brokers based on the size and requirements of the Site.

You can use the N+1 redundancy approach when planning Connection Broker availability. For environments using auto-promotion, follow the requirements described in **Configuring RAS Connection Brokers**.

A three-Connection-Broker configuration is particularly useful for environments that use Providers and require high availability for VDI.

Standby Connection Brokers do not participate in active runtime workload processing and therefore have different resource and performance considerations from active Secondary Connection Brokers.

### Adding a secondary RAS Connection Broker to a Site

To add a secondary Connection Broker:

1. In the RAS console, navigate to **Farm** > \<Site> > **Connection Brokers**.
2. Click the **Tasks** drop-down list and choose **Add** to launch the **Add RAS Connection Broker** wizard.
3. The **Server** field specifies the FQDN or IP address of the server that hosts the RAS Connection Broker. To automatically resolve the IP address to an FQDN, enable the global Name Resolution option. For details, see [**Host Name Resolution**](https://docs.parallels.com/landing/ras-admin-guide/parallels-ras-21-administrators-guide/common-management-tasks/host-name-resolution)**.**
4. The **IP** field specifies the server IP address. Click the **Resolve** button to obtain the IP address automatically using the FQDN specified in the **Server** field.
5. The **Alternative IPs** field specifies one or more alternative IP addresses, separated by a semicolon. These addresses will be used if RAS Secure Gateways fail to connect to the RAS Connection Broker using its FQDN or the address specified in the **IP** field. This can happen, for example, if Secure Gateways are connecting from a different network, which is not joined to Active Directory.
6. Select the **Install a Secure Gateway with a Connection Broker** option if you also want to install a RAS Secure Gateway on the specified server. If you select this option, you may also select the **Enable HTML5 Gateway** option (for more info, see [**Configure User Portal**](https://docs.parallels.com/landing/ras-admin-guide/parallels-ras-21-administrators-guide/ras-secure-gateway/configuring-a-ras-secure-gateway/configure-user-portal)**)**.
7. Select the **Add Firewall Rules** option to automatically configure the firewall on the server. See **Port Reference** for details.
8. Click **Next**.
9. On the next page, click **Install** to install the RAS Connection Broker on the server. The **Installing RAS Redundancy Service** dialog opens.
10. Select the server on which the RAS Connection Broker is to be installed and click **Install**.
11. Click **Done**.
12. Click **OK** to add the server to the Farm.halb


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.parallels.com/landing/ras-admin-guide/parallels-ras-21-administrators-guide/ras-connection-broker/secondary-connection-brokers.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.