topic Re: Manual sync of PSNs to the cluster after PSN loses connectivity in Network Access Control

Manual sync of PSNs to the cluster after PSN loses connectivity

umahar — Wed, 07 Jun 2017 19:19:58 GMT

We are doing some HA testing of PSNs in 2 datacenters. We noticed that when we bring down PSNs and bring them back again they do not automatically sync back to the cluster and have to be manually synced.

Is this an expected behavior ?

Re: Manual sync of PSNs to the cluster after PSN loses connectivity

paul — Thu, 08 Jun 2017 00:44:10 GMT

I have seen something like this before. Did you disabled the ISE service on the PSN to simulate a failure or shut down the switch port (if appliance) of the ISE PSN. I think when I saw this issue I shut down the switch port so the ISE services were still running. I was also doing full failover testing (admin failures, M&T failures and PSNs) one at a time. I noticed after I as finished and we were back to the starting state I had to manually sync one of my nodes.

I am doing the same testing at another customer today on 2.2 patch 1. They have all VMs so I am stopping services.

Re: Manual sync of PSNs to the cluster after PSN loses connectivity

umahar — Mon, 12 Jun 2017 16:08:45 GMT

Hi Paul,

I did a port shutdown of switch interface. Is this an expected behaviour ?

I'll wait for Cisco TMEs to confirm.

Re: Manual sync of PSNs to the cluster after PSN loses connectivity

kthiruve — Mon, 12 Jun 2017 17:27:49 GMT

When you do a “sh application status ise” what does it show you.

Are the ISE services running? That is the first step.

When it comes up, can you also make sure PSN appears connected in PAN UI.?

-Krishnan

Re: Manual sync of PSNs to the cluster after PSN loses connectivity

paul — Tue, 13 Jun 2017 20:39:47 GMT

Utkarsh,

Juts an update end. I did the testing last week with a customer running VMs so we shut down services to simulate a failure vs. shutting down the switch ports. Everything worked and there were no sync issues. So it seems like when you shut down the switchport and the ISE services stay up node it may have a problem getting sync’d back up with the deployment once you reenable the switch port. Not sure if this is expected behavior or not.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250

Re: Manual sync of PSNs to the cluster after PSN loses connectivity

umahar — Tue, 13 Jun 2017 23:05:37 GMT

Paul,

I experienced the same with VM today. No issues with sync when stopping and starting ise service.