topic Re: Getting secondary node from sync pair? in Network Access Control

Getting secondary node from sync pair?

OrkhanRustamli — Mon, 10 Aug 2020 12:58:40 GMT

Hi everyone.

I need to clarify one important thing about Cisco ISE 2 node deployment. Our office is preparing for big building migration and process is difficult as we have 24/7 Customer Support. I am planning to take secondary node from current network and move it to new office together with its subnet to prepare AWS Remote VPN connection so that while turning off all main network devices in current building, people will still be able to connect to VPN which authenticates with new ISE. So question: Is everything okay with my plan? Can Secondary node survive for 2 weeks with not communicating with main node?

Re: Getting secondary node from sync pair?

Damien Miller — Mon, 10 Aug 2020 13:43:25 GMT

It will sort of survive that, when a node is powered off that long it will require a manual resync from the GUI.
You would be best off just building a new secondary admin node at the site it will live in, then when you're ready, shut down the current and join this new node to the deployment. Assuming these are virtual.

If it is a physical SNS appliance, move it, readdress it, rejoin it to the deployment.

At the worst here, you will have to think about the limited high availability you have missing a node for a couple weeks. Rejoining/moving the node is the relatively easy part.

Re: Getting secondary node from sync pair?

OrkhanRustamli — Tue, 11 Aug 2020 07:28:34 GMT

Hi and thank you very much for response.

The appliances are physical and as I understood there must not bet any problem just for separating secondary node from admin for specific time. Thanks again!