topic ISE Secondary node sync up failed in Network Access Control

ISE Secondary node sync up failed

aravikumar — Fri, 21 Feb 2020 19:09:01 GMT

Hello,

In our customer environment, the Node status of the secondary ISE node is showing up as "Replication Stopped".

By logging into the CLI, we checked the ntp server configuration of both primary and secondary nodes they are the same.

We tried to sync up the secondary node manually from GUI but we are seeing the following error

"Unable to sync node Secondary-ISE-Hostname"

Please check the attached screenshots. Any help would be appreciated.

Thanks,

Aravind Ravikumar

Re: ISE Secondary node sync up failed

Arne Bier — Wed, 21 Aug 2019 05:51:57 GMT

Any idea what changed since this started happening?

What does the "show application status ise" show on the secondary node?

Are they on same VLAN? If not, is there IP connectivity between the two nodes? can they ping each other (if ICMP is allowed).

If all else fails ... reboot does a world of good 😞

Re: ISE Secondary node sync up failed

Afolarin Omole — Wed, 21 Aug 2019 09:57:23 GMT

@aravikumar

Seen this before , de-register the secondary device and register it again , then re-sync . But in my own case i did couple of things which are listed below :

De-register the SEC PAN ( making the device standalone)
Reset context visibility using application config ise command
Resetconfig using application reset-config ise command

After doing the above , then i re-register the secondary PAN , i did all this within a change window , so i don't know it effect on production. Just know that doing all the above will restart ISE service.