topic Re: Two ISE Policy Nodes, One DNS Name in Network Access Control

Two ISE Policy Nodes, One DNS Name

no_prop — Wed, 12 Dec 2018 22:30:42 GMT

We have two policy nodes. When one goes offline the DNS name for provisioning is not updated with the IP address of the second node. What is the recommended best practice so that when the primary provisioning server goes offline, it's DNS record is updated with the IP address of the secondary node? Thanks!

Re: Two ISE Policy Nodes, One DNS Name

Francesco Molino — Thu, 13 Dec 2018 02:36:09 GMT

Hi

When you say provisioning is for byod features?
Or for any authorization profile?

On your authz profile, you can specify 1 fqdn but you need to have a load balancer to send the traffic to one or the other. If you just use dns, it'll do kind of hashing and some features like guest won't work correctly.
The other option, depending on your design, you can have an anycast design on the 2nd nic and then have only 1 fqdn.

If you don't setup a fqdn in your authz profile, it will return it's own hostname with its dns suffix. If services are on additional nic (not the 1st), you can configure an alias and ise will return this value.

Re: Two ISE Policy Nodes, One DNS Name

Jason Kunst — Thu, 13 Dec 2018 02:41:52 GMT

I would recommend looking at the Cisco live for performance and scale for any cast load balancing questions

https://community.cisco.com/t5/security-documents/ise-training/ta-p/3619944#toc-hId-1281981443