topic Re: Radius dead server with LB in Network Access Control

Radius dead server with LB

csavas — Fri, 19 Oct 2018 08:56:06 GMT

Hi all,

I have a general design question;

is there a need at all to have a dead server configured on ISE if we have an LB in place?

What is the general recommendation?

Thanks,

Cengiz

Re: Radius dead server with LB

Ben Walters — Fri, 19 Oct 2018 12:08:13 GMT

It really depends on your ISE setup, if you only have one site where your ISE servers sit and they are all behind a LB for the services you don't have to worry about a dead server backup because the LB should determine if a server failed and remove it from the pool while the others still serve requests.

However if you have 2 different sites each with their on set of ISE servers you could configure your devices to use one as the primary and the second as the dead server backup. This is how ours is setup, we have a main and backup datacenter which has 2 ISE pools behind LBs.

Unless of course you were using something like F5's GTM (Big-IP DNS) that does LB across the WAN.

Re: Radius dead server with LB

paul — Fri, 19 Oct 2018 12:30:17 GMT

If your ports are in open mode you don't need the dead server config at all. If you are in closed mode, you also have to think about the site losing access to the LB VIP. It is unlikely that the VIP will be down, but what if the site loses access to the VIP for some reason.