topic Primary administration ISE nodes failed in Network Access Control

Primary administration ISE nodes failed

Rian Rosidiyana — Mon, 11 Mar 2019 03:26:24 GMT

Hi All,

I'm going to implement 3 ISE with destributed deployment, 1 ISE will configured as Administration & Monitoring node, and the others as dedicated Policy Service node.

My questions are :

1. If the Administration & monitoring node failed, are the authentication, authorization and posture still can be running well on the client ?

2. Can we promote the dedicated Policy Service Node as the new administration & monitoring nodes ? If can, how the procedure for promoting it? it's just as simple as promoting the secondary nodes (in case we have primary and secondary nodes) or there is others effort, such as must restoring the database or etc?

Thanks?

Regards,

Rian

Re:Primary administration ISE nodes failed

Tarik Admani — Thu, 16 May 2013 12:57:55 GMT

Hi,

When the primary administration node fails. The psns will still continue to function and enforce policies.

Since you have a single administration node and if the that node has to be rebuilt, all other nodes will also have to be reset to factory then re registered once the primary node is ready again.

In that case you can open a tac case yo have them assist in pulling your database from one of the psn nodes.

As always this is my observations and what I would do if I was in the situation, we can wait for a cisco engineer to respond or you can post this question in a tac case to make sure there isn't an upcoming feature which addresses this scenario.

Sent from Cisco Technical Support Android App

Primary administration ISE nodes failed

harvisin — Wed, 22 May 2013 03:29:10 GMT

Hello,

For your first question which is :-

Q:- If the Administration & monitoring node failed, are the authentication, authorization and posture still can be running well on the client ?

Ans:- Yes, the PSN's will still be running to their full functionality and would be doing the work of policy enforcements.

For your second query please find the link below which would help in ssolving your query:-

http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.html

Primary administration ISE nodes failed

Rian Rosidiyana — Wed, 22 May 2013 04:12:19 GMT

Hi Tarik and harvincer,

Thank you for your response.

After re read again about geployment guide and ISE user guide, for my question no.2 , i found out that if my administration node failed, i have to rebuilt the system (reregister PSN). and don't forget to always backup ISE, because it's very important when we've lost all administration nodes

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_backup.pdf