topic ise node not becoming standalone after deregistration in Network Access Control

ise node not becoming standalone after deregistration

Kashish_Patel — Mon, 11 Mar 2019 02:53:11 GMT

I am seeing a weird problem.

I deregistered secondary admin/monitor node from primary admin/monitor node. I see successfully deregistered message.

But the deregistered node is still showing SEC(A) and SEC(M). It is not changing to standalone mode.

This is disrupting the upgrade of distributed deployment of ISE nodes.

Any clues?

ise node not becoming standalone after deregistration

Kashish_Patel — Wed, 12 Dec 2012 07:36:00 GMT

We are running

1.1.0.665 with patch 3 installed.

ise node not becoming standalone after deregistration

nspasov — Wed, 12 Dec 2012 18:53:25 GMT

Are you able to login to the secondary node after you de-register and convert it to a standalone?

ise node not becoming standalone after deregistration

Tarik Admani — Fri, 14 Dec 2012 04:48:14 GMT

Seems as if there is some communication issues between the two nodes. I have seen this before and the best bet is to reset the config and restore the db from the administration node. I dont think forcing it to primary will do anything but its worth a shot.

Tarik Admani
*Please rate helpful posts*

ise node not becoming standalone after deregistration

Kashish_Patel — Fri, 14 Dec 2012 04:51:38 GMT

Hi Tarik,

We found that it was because of bug:CSCtz80240

Thanks.

ise node not becoming standalone after deregistration

Tarik Admani — Fri, 14 Dec 2012 04:53:34 GMT

Thanks for the update, if you opened a TAC case please make sure the bug is customer facing before closing this case. Can you share with us the details of this bug? And the workaround. High 5 for you providing this info.

Thanks,

Tarik Admani
*Please rate helpful posts*

ise node not becoming standalone after deregistration

nspasov — Fri, 14 Dec 2012 04:58:38 GMT

Yep, 5 pints from me too And yes, please do share some more info on the bug. I will also recommend that you move to 1.1.1 as soon as possible (or 1.1.2) as 1.1.0 had a lot of DB issues.

ise node not becoming standalone after deregistration

Kashish_Patel — Fri, 14 Dec 2012 05:00:11 GMT

Bug details:

Secondary node never becomes standalone after de-registration

The secondary node is de-registered successfully but a "The following deregistered nodes are not currently reachable: . Be sure to reset the configuration on these nodes manually, as they may not revert to Standalone on their own." message appears to the administrator.

Workaround Log in to the administrator user interface with internal Cisco ISE administrator credentials when de-registering a node.

Actually we had two accounts in web gui, nodes were registered using one account and during upgrade, i used different account , which triggered this bug.

ise node not becoming standalone after deregistration

Tarik Admani — Fri, 14 Dec 2012 05:03:49 GMT

Thanks Kashish for the helpful info....just out of curiosity do you know if you use and AD mapped account will trigger the same bug. I am planning for an upgrade from 1.1.1 to 1.1.2 and we have mapped AD accounts to the SuperAdmin role. I am curious if TAC was able to shed some light on this scenario.

Thanks again for this very helpful info!

Tarik Admani
*Please rate helpful posts*

ise node not becoming standalone after deregistration

Kashish_Patel — Fri, 14 Dec 2012 05:07:38 GMT

Tarik,

I am not sure about AD mapped admin accounts. We were using local accounts on ISE Web GUI.

Thanks,

Kashish

ise node not becoming standalone after deregistration

Tarik Admani — Sat, 15 Dec 2012 14:45:01 GMT

No problem, I will circle back and update once I can verify this in the lab. In the meantime can you mark Neno's first post as the solution so this topic can be marked as resolved.

Thanks,

Tarik Admani
*Please rate helpful posts*