topic Re: What happens when ISE Primary Admin node (and Secondary Admin node) are down? in Network Access Control

What happens when ISE Primary Admin node (and Secondary Admin node) are down?

dazza_johnson — Thu, 07 Sep 2017 02:08:56 GMT

Hey there, first of all a quick acknowledgement that of course you make sure the ISE Admin nodes are highly available.....

However, what actually fails if both the Primary Admin node (and Secondary Admin node) are offline for say 15 minutes? In my (non-scientific) test when I rebooted the Primary Admin node (and Secondary Admin node) the authentications to the PSNs continued to work from what the users told me.

My initial conclusion is that you lose the ability to manage the ISE deployment (configure or monitor it) but that the authentications continue to work. This seems too simplisitic, is there anything official on this as to what works/doesn't work when the Primary Admin node (and Secondary Admin node) are down?

Thanks

Re: What happens when ISE Primary Admin node (and Secondary Admin node) are down?

Charlie Moreton — Thu, 07 Sep 2017 12:01:16 GMT

If both Admin Nodes are down, the services affected are (I know the table states the Primary is down and the secondary has yet to take over. In this situation, both nodes are effectively down):

Cisco Identity Services Engine Administrator Guide, Release 2.3 - Set Up Cisco ISE in a Distributed Environment [Cisco …

Re: What happens when ISE Primary Admin node (and Secondary Admin node) are down?

felipesanchezº — Thu, 09 Apr 2020 00:38:42 GMT

Hi,

What happens when both nodes still down. How can I recover the admin services in the deployment?

Re: What happens when ISE Primary Admin node (and Secondary Admin node) are down?

Greg Gibbs — Thu, 09 Apr 2020 06:12:34 GMT

If both the Primary and Secondary PAN fail and are un-recoverable, you would need to rebuild them (if hardware failures, it would require opening a TAC case for an RMA) and restore from the most recent Configuration Backup.