topic ISE PSN node down in Network Access Control

ISE PSN node down

cae_technology — Thu, 16 Sep 2021 14:52:09 GMT

Ise 3.0 patch 2 in deployment page the psn node is showing down but i can ssh into it.

I know it relies on a heartbeat but it's in the same vm environment so there is no acl or rules.

Topped/start services and performed a reload and looked at sftp backups which happen weekly and are successful.

Primary PAN i can't ping the psn and vice versa but ssh is working.

Any ideas? Thanks

Re: ISE PSN node down

howon — Thu, 16 Sep 2021 14:54:48 GMT

I would focus on the connectivity between PAN and PSN as you mention the ping does not work. If not ACL, is it possible the route between the two or maybe incorrect IP settings such as subnet mask?

Re: ISE PSN node down

Damien Miller — Thu, 16 Sep 2021 16:07:24 GMT

If you have any queue link alarms on the dashboard then we could possibly also point to the ISE messaging service not operating correctly. The health status alarms + dashboard statistics come across via syslog messages, so if the messaging service is having issues then we see this as a symptom.

If you have queue link alarms actively being generated then you can regenerate the ISE messaging certification from the Certificate Signing Request (CSR) page.