topic Guest accouns in ISE distributed deployment in Network Access Control

Guest accouns in ISE distributed deployment

milos_p — Mon, 06 Sep 2021 12:03:53 GMT

Hi guys,

I will deploy ISE in distributed deployment, meaning:

2x PAN/Mnt

4x PSN nodes

I know sponsor portal is hosted on the PSN nodes.

My question is, if there is any synchronization of the guest accounts between PSN nodes that are created via sponsor portal?

Are the accounts created via sponsor portal on PSN node 1 available to be used on other PSN nodes?

Thanks a lot!

Milos

Re: Guest accouns in ISE distributed deployment

balaji.bandi — Mon, 06 Sep 2021 12:08:27 GMT

yes distributed deployment automatically sync the information.

here is some informaiton help you :

https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/tac-p/3687738#M5894

Re: Guest accouns in ISE distributed deployment

milos_p — Mon, 06 Sep 2021 12:29:06 GMT

Hi,

So you want to say I can make guest accounts on any PSN node (via sponsor portal on that PSN node), and they will be available to use on all the PSN nodes?

Thanks,

Milos

Re: Guest accouns in ISE distributed deployment

poongarg — Mon, 06 Sep 2021 14:30:22 GMT

The PSN do a RPC call to PAN and tell to add account to its configuration database, and then via normal replication at TCP port 12001 the information is sent to other PSN's. So yes, the account can be used on all other PSN nodes.

Re: Guest accouns in ISE distributed deployment

milos_p — Tue, 07 Sep 2021 06:39:26 GMT

This explains the logic, thank you very much!

Just one more thing. Apart from being able to use guest accounts on all PSN nodes, are they also visible in the sponsor portals of the other PSN nodes as well, or only in the one that accounts were created originally?

Re: Guest accouns in ISE distributed deployment

poongarg — Tue, 07 Sep 2021 07:06:55 GMT

Guest account created on one PSN sponsor portal should be visible on sponsor portal of other PSN as well.