topic Re: Power-on and Power-off Order in ISE Distributed Deployment in Network Access Control

Power-on and Power-off Order in ISE Distributed Deployment

taiijima — Fri, 24 Aug 2018 07:20:19 GMT

Hi Team,

When powering on and powering off ISE nodes in distributed environment, what would be the recommended order of the nodes we should operate?

I'm assuming the deployment of Primary PAN, Secondary PAN with Auto-Failover, Primary MnT, Secondary MnT and 6 PSN nodes which have Health Check node. So, could you please let me know the recommended order of this scenario?

Thanks,

Takuya

Re: Power-on and Power-off Order in ISE Distributed Deployment

RichardAtkin — Fri, 24 Aug 2018 10:22:44 GMT

Good question.

I can't say that I've seen this documented anywhere, but presumably the order to turn them off would be;

All PSNs

Secondary Monitoring

Secondary Admin

Primary Monitoring

Primary Admin

Turning them back on again would be the reverse, so start with Primary Admin and work up the list.

Happy to be criticised if others know better!

Re: Power-on and Power-off Order in ISE Distributed Deployment

taiijima — Mon, 27 Aug 2018 14:48:49 GMT

Thanks for your comment.

I would like to know BU's opinion also. Could anyone from BU respond to this question please?

Thanks,

Takuya

Re: Power-on and Power-off Order in ISE Distributed Deployment

hslai — Thu, 30 Aug 2018 02:44:17 GMT

I believe you are wanting to avoid the auto failover so either disabling that until bringing things up or shutting down the secondary admin node first and bringing it up later. If needing the monitor nodes to capture the last bit of operational data, then shut those down the last and bring them up first. Several operations on the PSNs depend on the primary admin node so it makes sense to shutting down PSNs before the primary admin node.

Re: Power-on and Power-off Order in ISE Distributed Deployment

taiijima — Thu, 30 Aug 2018 10:40:19 GMT

Thanks for your reply. I understood that actually there is no restricted one-by-one order, but there are some points we need to take care. For the monitor nodes you mentioned, is it possible to boot it up earlier than P-PAN, and to shutdown it later than P-PAN?

Thanks,

Takuya

Re: Power-on and Power-off Order in ISE Distributed Deployment

hslai — Thu, 30 Aug 2018 15:58:11 GMT

Yes, no known issue to keep MNT running while the primary PAN is down, other than we will not be able to access the ISE admin web UI to see the operational data.