topic ISE Primary Node Rebuild in Network Access Control

ISE Primary Node Rebuild

dm2020 — Tue, 22 Jan 2019 23:32:46 GMT

Hi All,

We have a single PAN/MnT node and two distributed PSN nodes. The version of the deployment is 2.3. I'm not sure why we have a single PAN but it needs to be rebuilt as it was under spec'd.

I'm trying to workout the best way to rebuild the PAN and if its a simple matter of building a new PAN/MnT node, backing up and restoring the config from the old PAN to the new PAN and then switching off the old node. I will then need to change the IP address of the new PAN/MnT to that of the original. Will this work ok? Will the PSNs be able to sync with the new PAN with this procedure?

A possible alternative solution is to build the new node, add it to the cluster as a secondary admin/MnT node, promote it to primary and then demote/decommission the old node. Will this be a better option?

Thanks all

Re: ISE Primary Node Rebuild

Damien Miller — Wed, 23 Jan 2019 01:17:57 GMT

If I was going to do this, I would do what you have at the bottom of your post. Build a new node, join it to the deployment as secondary, promote it to primary, decommission the old pan.

Re-deploy/rebuild the original PAN, promote it to primary, keep the second PAN/MNT for HA.

Re: ISE Primary Node Rebuild

Nidhi — Wed, 23 Jan 2019 04:21:51 GMT

Damien suggested it right. Also, dont forget to backup the data.

Thanks,

Nidhi

Re: ISE Primary Node Rebuild

Mohammed al Baqari — Wed, 23 Jan 2019 05:12:04 GMT

I agree on 2nd option. Rebuild as sec then promote as primary.