topic Re: ISE PSN Node Group in Network Access Control

ISE PSN Node Group

fatalXerror — Tue, 26 Feb 2019 20:25:21 GMT

Hi Guys,

Does the PSN node groups will provide HA for my PSNs during upgrade process of the PSNs resulting to no service (authentication) disruption?

Can I upgrade PSNs even if that PSN is part of the node group?

Thanks

Re: ISE PSN Node Group

Damien Miller — Wed, 27 Feb 2019 00:01:13 GMT

Node groups don't necessarily provide HA for your NADs, they just share extra information about endpoints with other nodes on the same L2 domain. They have a basic monitor role of their peers so that they can help client authentication recover when a node fails mid web redirect. The HA and impact of an upgrade is dependent on how you have the radius servers configured on the NAD, not the node groups.

If you want HA during an upgrade you still need to make sure you have at least two radius servers configured on each NAD, and at least one of those servers is online and able to authenticate endpoints.

If you go look up the CiscoLive.com library session BRKSEC-3699, there is a detailed section on the function of node groups in the reference slide deck.

Re: ISE PSN Node Group

fatalXerror — Wed, 27 Feb 2019 05:42:16 GMT

Hi @Damien Miller ,

Thanks for the feedback.

But why in the Cisco ISE Upgrade Guide states that if we are upgrading PSNs which is in a node group will have no interruption?

In addition, the PSN will not be in service if the PSN is undergoing upgrade right meaning PSN is still up so the NAD will still communicate to that PSN because it is still reachable?

Thanks