topic Re: ISE cannot register second node in Network Access Control

ISE cannot register second node

mmercaldieze — Thu, 01 Nov 2018 17:14:30 GMT

I am trying to register my secondary node on my ISE 2.4 solution. The nodes can ping eachother's hostnames and have each other's certificates. Is there a log that will tell me why they are erroring out?

Re: ISE cannot register second node

hslai — Thu, 01 Nov 2018 20:21:24 GMT

I would start with the application log ise-psc.log and the system log ade/ADE.log first.

Re: ISE cannot register second node

Arne Bier — Thu, 01 Nov 2018 21:57:10 GMT

Usually this is quite straightforward

The secondary node must be in STANDALONE mode.

The secondary node must be at identical patch level as the Primary.

DNS resolution must resolve the FQDN of both nodes.

PAN must trust the secondary node's cert

Firewalls between the nodes? Install Guide lists all the ports ...

Failing all that, something strange is going on. The ise-psc log should reveal cause.

Re: ISE cannot register second node

Damien Miller — Fri, 02 Nov 2018 04:07:36 GMT

Beyond what was already mentioned above me, two potential issues come to mind which we don't have enough information to rule out.

There is an odd bug if you were using an older patch on 2.4 and upgraded from 2.3.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj44088

The second thing I have seen on a freshly installed node joining to an existing deployment. The deployment had a different admin password than the fresh node. During registration, the new node would fail to register, further investigation showed an alarm for admin lockout. I disabled admin lockout on the new node, registered fine after. Something I only found on 2.4 without patches.

If you can't figure it out from the logs hslai shared, you can work with TAC and they will debug the issue.