topic ISE Nodes out of sync in Network Access Control

ISE Nodes out of sync

joeharb — Thu, 03 Oct 2019 20:46:05 GMT

We made were making some changes to our ISE deployment and then noticed that the nodes (2) were not in sync. We have tried the manual sync and we have deregistered the node and did an application reset-config but this has not worked. We are attempting to get a TAC case started but having troubles with maintenance contract provider.

I am hoping to have support tomorrow but would like any suggestions to see if I can resolve the issue.

Thanks,

Joe

Re: ISE Nodes out of sync

Colby LeMaire — Thu, 03 Oct 2019 21:44:16 GMT

Are there any firewalls in between your PAN and the secondary nodes that are out of sync? If so, check the firewall logs to see if anything is being dropped. Maybe restart the services on the PAN? And give it some time too. Depending on how far out of sync they are, it could take a while. Otherwise, work with TAC as soon as you can.

Re: ISE Nodes out of sync

joeharb — Tue, 08 Oct 2019 16:48:53 GMT

After working with TAC a reboot of the primary node was performed last night and the nodes are now registered. One last issue we have is that we use RSA SecureID as a external identity source. The secondary node is still failing for TACACS/Radius as it can't look up users on in RSA. Checking the nodes I see that the secondary node doesn't have a Node Secret. I don't want to break the node that is working but how do I get the secondary node working again with RSA?

Re: ISE Nodes out of sync

joeharb — Tue, 08 Oct 2019 19:13:20 GMT

We were able to correct the issue by going into RSA and clearing the node secret, on the next attempt, ISE and RSA created an new shared secret.

All is good now..

Thanks,

Re: ISE Nodes out of sync

Colby LeMaire — Tue, 08 Oct 2019 19:51:51 GMT

Excellent! Glad to hear it's all working now.

Re: ISE Nodes out of sync

paulo cobo — Thu, 15 Feb 2024 15:21:47 GMT

I had the issue and was not able to Sync. The RELOAD command on primary node CLI fixed it.