topic Re: Difference between enabling Primary/Secondary in ISE and enabling failover in Network Access Control

Difference between enabling Primary/Secondary in ISE and enabling failover

abhijith891 — Fri, 21 Feb 2020 19:01:02 GMT

Hi all,

I have received a distributed environment for Cisco ISE from a client where they have configured an ISE node in one location as Primary in Admin, Sec in Monitoring and another ISE in another location as Secondary in Admin, Primary in Monitoring. So I just wanted to know how different is this scenario if failover was enabled between them.

Regards,

Abhijit

Re: Difference between enabling Primary/Secondary in ISE and enabling failover

balaji.bandi — Tue, 17 Jul 2018 20:56:26 GMT

I suggest to have a look at one of the cisco Live presentation, and you have more clarity about the setup.

It all depends on how you choose and deploy.

http://d2zmdbbm9feqrf.cloudfront.net/2015/eur/pdf/BRKSEC-3699.pdf

Re: Difference between enabling Primary/Secondary in ISE and enabling failover

Arne Bier — Wed, 18 Jul 2018 00:06:58 GMT

I had the same question once because I read about that exact scenario in an ISE book called "

Practical Deployment of Cisco Identity Services Engine (ISE): Real-World Examples of AAA Deployments"

The author talks about this and it appears to make sense for hardware ISE nodes where you want to spread the work load between Active PAN and Active MnT. Why make one node Active PAN and Active MnT, while the other node just sits around in Secondary mode?

But when I asked this question to the Cisco TME's on the ISE Community Forum, they told me not to do what you're describing. In other words, keep both the PAN and MnT personas Active on one node, and Standby on the other node.

Re: Difference between enabling Primary/Secondary in ISE and enabling failover

abhijith891 — Wed, 18 Jul 2018 01:27:55 GMT

Thanks everyone for your suggestions but I think I have not made myself clear; so i will rephrase. My question was: Whats the difference between enabling failover between 2 devices/personas and configuring primary/secondary between 2 devices/personas. Which method is better?

Re: Difference between enabling Primary/Secondary in ISE and enabling failover

abhijith891 — Wed, 18 Jul 2018 01:29:41 GMT

Re: Difference between enabling Primary/Secondary in ISE and enabling failover

Arne Bier — Wed, 18 Jul 2018 01:57:07 GMT

Just to be clear, I understand you have two nodes that have the Admin and Monitoring personas enabled.

In that case there are two possible combinations

Combo 1:

Node 1: Primary Admin, Primary MnT

Node 2: Secondary Admin, Secondary MnT

Combo 2

Node 1: Primary Admin, Secondary MnT

Node 2: Secondary Admin, Primary MnT

Now your question is about failover?

There is no MnT failover as such, but as you probably know, you can promote the Secondary MnT to Primary and this will not cause any disturbance or changes to the PAN persona.

The PAN is a bit different. If you promote the Secondary PAN to Primary, then the application services will restart on both nodes.

After a PAN promotion the result will be as follows:

Combo 1: (no change to MnT)

Node 1: Secondary Admin, Primary MnT

Node 2: Primary Admin, Secondary MnT

Combo 2: (no change to MnT)

Node 1: Secondary Admin, Secondary MnT

Node 2: Primary Admin, Primary MnT

I don't understand what the question is - there is no design choice (or considerations) as far as I can see. Unless I still haven't understood the question.

By the way, what do you mean by "enable failover"? Are you talking about Automatic PAN Failover? As far as I know, it's just the automated way of doing the same thing as I described above. You need an outside PSN (in your case) to be the monitors who decide when to trigger the promotion. Is that what you're trying to achieve? In that case the design question is, WHICH PSN do I designate to monitor which PAN node.

I would argue that the PSN closest to the PAN (i.e. in same data centre) is the one to use because it would allow the PAN to be monitored in the event of an inter-data centre WAN failure. If WAN link fails then there will be no PAN promotion since each PSN believes their PAN is alive. If you chose the alternative, using cross-DC PSN monitors, then a WAN failure would cause the Standby PAN to be promoted, and you'll have two active PAN nodes with a split brain network. This is to my knowledge how it would work - but I stand to be corrected.