topic Cisco ISE 1.4 - Automatic Failover in Network Access Control

Cisco ISE 1.4 - Automatic Failover

abhijith891 — Mon, 15 Oct 2018 20:20:16 GMT

Hi All,

We have 4 ISEs in our environment, 3 of them in one DC(US) and 1 in another(Europe). We have a PAN in US which is configured as Primary in Administration, Secondary in Monitoring. The Europe ISE has 3 personas; i.e Primary in Monitoring, Secondary in Administration and also acts as a PSN. The remaining 2 nodes in US are acting as PSNs.

We are considering to implement Automatic Failover so I would like know a few things:

i) Does a PAN and a health-check node necessarily need to be in the same DC? What are the possible issues that might come up if they are in different DC?

ii) For the above environment, which is the best way to implement automatic failover for all 3 personas - Administration, PSN and Monitoring?

Any suggestions/recommendations would be greatly appreciated.

Re: Cisco ISE 1.4 - Automatic Failover

paul — Tue, 16 Oct 2018 12:22:47 GMT

I have always done the PAN healtcheck from devices in the same DC. I can't speak to ramifications if you don't do that, but I have a few other points:

For best performance your primary admin and M&T should be in the same location. I would have the US node be the primary PAN and M&T.
For M&T redundancy you don't need to do anything special. All nodes log to both M&Ts automatically and the deployment will switch M&Ts as needed based on availability.
Your PSN redundancy is determined by your network devices. If you want in US they can point to US PSNs first then Europe. In Europe the network devices can point to Europe first then US.

Re: Cisco ISE 1.4 - Automatic Failover

Jason Kunst — Tue, 16 Oct 2018 12:32:08 GMT

Good points. Also recommend moving to ise 2.2 (current recommended release) or even 2.4 now that several patches have been out as there are a lot of changes

Ise 1.4 is end of support

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/eos-eol-notice-c51-738841.html