topic Re: Promote Cisco ISE Secondary Admin node to primary Admin Node in Network Access Control

Promote Cisco ISE Secondary Admin node to primary Admin Node

Mounica Venigalla — Fri, 21 Feb 2020 18:55:37 GMT

Hi,

I am planning on promoting Cisco ISE 2.3 Secondary admin node to primary, it is an 3495 appliance, my question is do i have to do a manual sync up before i promote it and my radius traffic which is currently being served by 4 PSN's will that be disrupted when my PAN restarts?

Please Advise.

Thanks

Re: Promote Cisco ISE Secondary Admin node to primary Admin Node

agrissimanis — Wed, 09 May 2018 12:42:43 GMT

Just make sure that the status of all your nodes is healthy and online, there is no need to do manual sync up.

In regards to the RADIUS auths on PSNs , they will not be disrupted, you just loose the ability to make changes and administer the deployment while the secondary admin node is being promoted to primary.

Re: Promote Cisco ISE Secondary Admin node to primary Admin Node

Rob Ingram — Wed, 09 May 2018 12:49:00 GMT

Hi,

The Primary PAN and Secondary PAN should be in sync all the time, unless an issue. No harm running a manual sync before promoting Secondary PAN to Primary.

During the period the old P-PAN is down and the Secondary is being promoted to be the new Primary PAN, the database would be offline for a period. Check out this section in the ISE Admin Guide to confirm what will and won't be effected when the PAN is down.

Depending on what services you are running on the PSNs you might find you will not impact authentications, but it might be wise to promote the PAN out of hours.

HTH

Re: Promote Cisco ISE Secondary Admin node to primary Admin Node

Mounica Venigalla — Wed, 09 May 2018 13:11:29 GMT

RJI,

My primary PAN is healthy nothing wrong with it and i want to promote my secondary PAN because it was primary prior to my ISE upgrade. Will both the PAN's restart after i login into the secondary pan and promote it?
if so will they restart at the same time or will they restart one after the other?

with respect to manual sync the node will restart again which will result my node to restart twice through the whole process, so i am trying to understand how important it is to do a manual sync.

Thanks

Re: Promote Cisco ISE Secondary Admin node to primary Admin Node

Rob Ingram — Wed, 09 May 2018 13:35:10 GMT

You should only need to manually sync if the nodes have a warning telling you they are out of sync.

When you perform the PAN promotion, the services on both nodes will restart at somepoint. Starting/Restarting the services in ISE is generally slow. So if you are running services such as guest, byod or anything that writes to the database you won't have access whilst for a period. If all you are running is basic 802.1x RADIUS auth, as agrissimanis said should not be disrupted.

Re: Promote Cisco ISE Secondary Admin node to primary Admin Node

Filippo Carzaniga — Wed, 22 Jan 2020 10:58:36 GMT

Hi All,

I personally experienced directly, when you are a design in redundancy Deployment ( 2 Node HA) in which you are PAN/MON/PSN on the same node, I can confirm the Both Node restart and this cause the outage service.