topic Re: ise maintenance in Network Access Control

ise maintenance

suthomas1 — Fri, 21 Feb 2020 18:45:00 GMT

Hello,

We have a distributed ise netork including 2 PAN with either of them acting as
primary/secondary monitoring node also & 2 Policy nodes. It has been running fine
for a while & we want to verify nodes again, as part of new program to be prepared
for unknown issues.this means, the nodes will be rebooted. All are vmwares.

ISE-PAN-A > Primary for administration & secondary for monitoring
ISE-PAN-B > Primary for monitoring & secondary for administration
ISE-PSN-A & ISE-PSN-B > Policy nodes

can someone please help to determine what order they should be rebooted.As also
any other suggestions/checks that should be used to make this smooth.

Thanks.

Re: ise maintenance

Mark Elsen — Tue, 06 Feb 2018 13:37:29 GMT

- You should have no issues rebooting the 4 nodes separately and in the order you mention. Well that is supposing that your NAD devices use the PSN's symmetrically and in 'failover' mode ! (no PSN is critical on it's own) (both are always used). Better also to not have policy-change work going on, on one of the admin nodes. Besides these low-profile issues, wait long enough between subsequent reboots and or issue via ssh show application status ise , to check wether a particular node is fully functional again.

Re: ise maintenance

suthomas1 — Wed, 07 Feb 2018 06:35:35 GMT

Thanks.
Is it more better to stop ise before the reboot & then start it again.
how can we ensure that there is minimal downtime doing the reboot. Is there
any particular order we should follow ?