topic Re: ISE failover Questions in Network Access Control

ISE failover Questions

Steven Williams — Mon, 26 Nov 2018 19:57:09 GMT

When I have two ISE nodes and they are set to primary and secondary on Admin, Monitoring, and Policy how does failover work with this? do I need to create a PAN failover group and add each one to it and enable failover?

When I start adding ISE servers to radius servers do I have to list both IP addresses of the ISE Servers?

Re: ISE failover Questions

paul — Mon, 26 Nov 2018 20:08:01 GMT

It is different for each persona:

Admin- in a two node deployment this is active/passive. If the primary admin fails you would need to go to the GUI of the secondary to promote it to be the primary. At that point the services will restart and authentication would be disrupted. If you have more than two nodes you can configure automatic failover.
Monitoring- always active/active. All ISE nodes log to both monitoring nodes simultaneously. If the primary monitoring node goes down the Admin persona will automatically start pulling data from the other monitoring node.
PSN- always active and you decide how you use them by how you point your network devices at them. You might say wired will be PSN #1 first then PSN #2 and wireless PSN #2 first then PSN #1.

Re: ISE failover Questions

Nadav — Mon, 26 Nov 2018 20:28:19 GMT

Good answer,

I'll just add that for Admin failover the primary doesn't automatically become the active node once it's up. You'll need to promote the primary node yourself.

For MnT persona the primary preempts back to working with the active PAN, so no need to promote anything.

Re: ISE failover Questions

Steven Williams — Tue, 11 Dec 2018 20:04:57 GMT

So when you add the secondary IP address to the AAA server group within the ASA there is no way to test the secondary node because its not responding to requests until its promoted to primary?

Re: ISE failover Questions

Nadav — Wed, 12 Dec 2018 05:53:20 GMT

Requests are handled by PSN nodes, not PAN or MnT. PSN nodes are always active, so you should be getting a reply from any of the PSN nodes assuming the right persona, protocols and policy are in place.