topic Distributed environment-ISE ports & communication in Network Access Control

Distributed environment-ISE ports & communication

nikhilcherian — Thu, 21 Sep 2017 15:52:47 GMT

Dear All,

Kindly help with the below queries regarding Distributed environment,

What all ports should be opened between ISE nodes in a Distributed environment. If the Admin node should communicate with the Policy Node, what all ports should be opened between these boxes.

Does the Policy Node directly communicate with the Monitoring Node or does the Policy Node send all the logs to the Admin Node & Admin node pass it on to the Monitoring Node

Thanks

Regards

Re: Distributed environment-ISE ports & communication

bravojared — Thu, 21 Sep 2017 15:58:13 GMT

The full list of ports used between each node (and for what purpose) are listed here:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/install_guide/b_ise_InstallationGuide23/b_ise_InstallationGuide23…

Re: Distributed environment-ISE ports & communication

nikhilcherian — Thu, 21 Sep 2017 19:23:05 GMT

Thanks for the link, I had gone thru the link before I posted the question. The link mentions about "Replication and Synchronization" & Clustering (Node Group)". In which category the communication between Admin Node & Policy Node falls in .

The link also doesn't provide any answer on my second question, as to how does the PSN communicate with MnT. Is it thru PAN or do they communicate directly

Regards

Re: Distributed environment-ISE ports & communication

bravojared — Thu, 21 Sep 2017 19:35:36 GMT

Current Diagram from same 2.3 guide you had link to...

Re: Distributed environment-ISE ports & communication

nikhilcherian — Thu, 21 Sep 2017 19:44:50 GMT

Many thanks for the quick help

Cheers

Re: Distributed environment-ISE ports & communication

nikhilcherian — Fri, 22 Sep 2017 03:52:04 GMT

In the diagram I can see you have configured the NAD to send syslog to the MnT server & not to the PSN server. Can you tell me why the syslogs should be send to the MnT

Regards

Re: Distributed environment-ISE ports & communication

Jason Kunst — Fri, 22 Sep 2017 04:01:18 GMT

This is for troubleshooting and event correlation only and should only be done when debugging

The monitoring and troubleshooting node is used for logging purposes

There is no need to send to psn

Re: Distributed environment-ISE ports & communication

nikhilcherian — Fri, 22 Sep 2017 04:07:09 GMT

Thanks Jason

Re: Distributed environment-ISE ports & communication

nikhilcherian — Tue, 12 Dec 2017 17:58:06 GMT

Hi jakunst,

Today when I tried to do a CoA for a client from my admin node, I could see there was a communication on port tcp/1700 between Admin & PSN. I couldn't this port reference in the communication between PAN & PSN anywhere.

Have you seen any communication in this port between PAN & PSN

Regards

Nikhil

Re: Distributed environment-ISE ports & communication

Jason Kunst — Tue, 12 Dec 2017 18:13:31 GMT

please reference the diagram attached to the thread, its mentioned right in the middle. PAN tells PSNs to do the COA