topic CISCO ISE - PSN Deployment in Network Access Control

CISCO ISE - PSN Deployment

TiUM — Sat, 21 Nov 2020 10:01:14 GMT

Hello all

I have three simple questions that I would like to know the answer, since I never done it before.

I have in production 2 nodes with PAN,MNT and PSN (One Primary and one Secondary) and I will take out the PSN role to a dedicated machine. So my doubts are in the configuration, right now I have the radius on all the switches pointing to the 2 nodes that have, since I will take off the PSN role to a dedicated node do I need to rebuild the entire configuration?

And with the policy’s do I need to do anything?

And in the networking tab where I add all the switches do I need to do some changes?

Thank you in advance for who can help me with this

Re: CISCO ISE - PSN Deployment

Mark Elsen — Sat, 21 Nov 2020 10:28:51 GMT

- In the running config of the switches, all you have to do is to point the radius-server-config to the dedicated PSN. But this is far from best practice. I would recommend to have at least 2 working PSN, for failover reasons.

Re: CISCO ISE - PSN Deployment

Kalimoz — Sat, 21 Nov 2020 13:43:24 GMT

Thank you for the reply,

Will definitely have 2 PSN's.

So that's the only thing i need to do? Add the PSN to the Deploy and change config in swith's, instead of appoint to the actual node will appoint to the new PSN right?

Re: CISCO ISE - PSN Deployment

Mark Elsen — Sat, 21 Nov 2020 17:41:11 GMT

- Switches determine which radius servers (PSN's) are used in the running config. On a first approach make sure that there are at least two. If you want to play with load balancing schemes and preferences , check this document :

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_rad/configuration/xe-16/sec-usr-rad-xe-16-book/sec-rad-load-bal.html

Re: CISCO ISE - PSN Deployment

rschlayer — Mon, 23 Nov 2020 16:14:43 GMT

Add the PSNs to the Deployment, point switches to the new PSNs, disable PSN role on the Admin Nodes.

BR
Rick

Re: CISCO ISE - PSN Deployment

TiUM — Mon, 23 Nov 2020 17:31:47 GMT

About the certificates that are installed even the public one for the Portal Guest, do i need to do anything or can stay in the PAN?