topic Re: Invalid health check monitoring request received for auto-failover. in Network Access Control

Invalid health check monitoring request received for auto-failover.

Aklilu Belay — Tue, 31 Mar 2020 08:00:34 GMT

We have a Cisco ISE 2.1 distributed deployment with 7 Cisco ISE nodes. (Two PAN, Three PSN and two MnT nodes). we are getting the below error on the PAN:
Invalid health check monitoring request received for auto-failover.

And on Cisco site here: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_011000.html

it says the solution is "Please verify if the health check monitoring node is out-of-sync and trigger a manual sync if needed."

But I am not sure which node was configured as the health check node. My question is; is there a way to find which node is configured as a health check monitoring node out of the 7 ISE nodes?

Thanks,

Re: Invalid health check monitoring request received for auto-failover.

Mark Elsen — Tue, 31 Mar 2020 08:41:20 GMT

- Probably can be figured out by having a look at the paragraph below :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_010.html#task_4B14550A96BF40A0906843411C8A96A6

Re: Invalid health check monitoring request received for auto-failover.

Aklilu Belay — Tue, 31 Mar 2020 11:14:47 GMT

The problem is "Enable PAN Auto Failover" checkbox is disabled. I was hoping there is another way of finding this information.

Re: Invalid health check monitoring request received for auto-failover.

Greg Gibbs — Tue, 31 Mar 2020 22:10:18 GMT

I would suggest checking Node Status on the Administration > System > Deployment page to see if any of the nodes are out of sync. If none of the nodes are showing out of sync, you might need to manually resync the PSN, MnT, and Secondary PAN nodes one at a time to see if the error goes away.

If you're comfortable looking at looking at debug logs, you might also have a look into the Replication logs for more info.

Please note that ISE 2.1 reached End of Support on 17 March 2020. You should strongly consider upgrading to a version supported by TAC.

Re: Invalid health check monitoring request received for auto-failover.

Aklilu Belay — Wed, 01 Apr 2020 05:58:49 GMT

I was actually doing a manual sync for all nodes and one of the nodes, which is an MnT node gives the below error after attempting to do a manual sync:
Node not in sync with PAP ,Please do a manual sync

I will attempt to find the logs. If you have any instructions/reference to do that, please let me know.

Re: Invalid health check monitoring request received for auto-failover.

Aklilu Belay — Mon, 06 Apr 2020 07:45:32 GMT

I downloaded and checked the replication log but couldn't find anything useful. I have attached it here if you want to check. svdcise01 is the primary PAN and svdrise01 is the one that should be secondary PAN>