topic Re: High Availability for AD or LDAP servers in distributed ISE environment in Network Access Control

High Availability for AD or LDAP servers in distributed ISE environment

umahar — Mon, 14 May 2018 21:25:38 GMT

Hi experts,

How is high availability between PSNs and local AD/LDAP maintained ?

In a distributed environment we add the fqdn of the domain on Admin Node and then all PSNs get joined to their local domain controller.

If that local domain controller fails does the PSN automatically joins the next domain controller in the DNS response ?

Do we need to register the PSN again when that failure happens ?

Appreciate if you can comment on various challenges in achieving high availability between ISE and AD/LDAP servers in a distributed environment.

Re: High Availability for AD or LDAP servers in distributed ISE environment

hslai — Mon, 14 May 2018 21:32:04 GMT

Specific to integration with AD join points, yes, ISE will try the next domain controllers as defined by Active Directory Site and Services.

As to LDAP, the HA is achieved by enabling secondary server.

Re: High Availability for AD or LDAP servers in distributed ISE environment

umahar — Mon, 14 May 2018 21:55:00 GMT

If the LDAP is defined by just one FQDN how would we add the secondary server ?

Customer has mentioned that DNS will return more than one IPs (primary and secondary ldap) for that FQDN.

Re: High Availability for AD or LDAP servers in distributed ISE environment

Craig Hyps — Mon, 14 May 2018 23:09:08 GMT

LDAP supports secondary server per PSN as well as a "force reconnect" option to periodically update DNS reply. LDAP targets can point to real server or LB VIP. See BRKSEC-3699 posted to ciscolive.com for more info on LDAP HA.

Re: High Availability for AD or LDAP servers in distributed ISE environment

umahar — Mon, 14 May 2018 23:32:47 GMT

Thanks Craig.

Do you know if ACS also supports these failover scenarios for AD and LDAP ?

Customer has ACS 5.8 but I am first trying to understand how its done in ISE and explore the same in ACS.

Thanks,

Utkarsh

Re: High Availability for AD or LDAP servers in distributed ISE environment

hslai — Tue, 15 May 2018 02:41:14 GMT

Force reconnect every N seconds

Check this check box and enter the desired value in the Seconds text box to force the server to renew LDAP connection at the specified time interval. The valid range is from 1 to 60 minutes.

available in ISE 2.1+ only, but not in any of ACS 5.x. ACS 5.x does support 2nd LDAP server and the option for "Enable Deployment Configuration", which is equivalent to "Specify server for each ISE node" in ISE 2.2+.