topic Re: Moving MnT from one ISE appliance to another. in Network Access Control

Moving MnT from one ISE appliance to another.

Anthony O'Reilly — Fri, 05 Nov 2021 12:18:39 GMT

Hi,

I have two ISE appliances in my deployment. The first ISE appliance is the primary node for Admin and Monitoring.

I want to move MnT to the second ISE appliance. Does this cause both ISE appliances to reboot? If only one ISE appliance reboots, which one reboots (first or second). I am trying to maintain service as much as I can during this change.

Thanks

Re: Moving MnT from one ISE appliance to another.

hslai — Mon, 08 Nov 2021 02:51:13 GMT

An ISE node will restart its services when the persona(s) change. I would suggest adding MnT as the primary MnT on the 2nd ISE. For the 1st ISE, remove the MnT persona in a maintenance window.

Re: Moving MnT from one ISE appliance to another.

Anthony O'Reilly — Mon, 08 Nov 2021 09:03:24 GMT

Thanks @hslai do this mean when I am moving the MnT to the secondary node, the secondary node do not restart its services. Only the primary mode will restart it services.

Re: Moving MnT from one ISE appliance to another.

hslai — Mon, 08 Nov 2021 15:59:45 GMT

If the 2nd ISE has no MnT and you add MnT to it, the 2nd ISE will restart its ISE services. If the 2nd ISE is serving other ISE services (esp. session services), please also do it in a MW. Changing ISE MnT roles between primary and 2nd will not restart ISE.

Re: Moving MnT from one ISE appliance to another.

Anthony O'Reilly — Wed, 24 Nov 2021 14:24:51 GMT

Hi @hslai I made this change and the service outage was about 7 minutes. No issues afterwards. thanks for your help.

Re: Moving MnT from one ISE appliance to another.

Ethan Grinnell — Fri, 07 Oct 2022 20:14:34 GMT

Adding my experience: We have a similar setup, 2 ISE nodes, one is primary PAN and MnT and the other is secondary PAN and MnT. I swapped MnT priority between the 2 nodes. Now the primary PAN is the secondary MnT. No restart was triggered for this change. The difference may have been that both nodes already had MnT persona and I was only changing which was the primary.

Re: Moving MnT from one ISE appliance to another.

oumodom — Mon, 09 Dec 2024 04:59:46 GMT

Hi @Anthony O'Reilly @hslai @Ethan Grinnell

I have the same scenario as mentioned on lab as we have 2 nodes configure as Deployment nodes,
Currently our PAN is secondary M&T, while secondary node is primary M&T. The objective is to change role PAN to primary M&T for Operational Backup and Configuration Backup.

Once we click change the role Primary M&T on PAN node, Does it require restarting both nodes or just restarting service? They will be down time both nodes ?
We need to ensure the operation/authentication no downtime.

Thank you,

Re: Moving MnT from one ISE appliance to another.

JPavonM — Wed, 11 Dec 2024 11:36:03 GMT

Node service restarts only happen when you change from one persona to another (like from monitor-2-administration or psn-2-monitor, or viceverssa) but not when you swap primary and secondary roles.

Re: Moving MnT from one ISE appliance to another.

oumodom — Thu, 12 Dec 2024 04:58:44 GMT

Thank @JPavonM for sharing your experience

Re: Moving MnT from one ISE appliance to another.

tom-pownall — Fri, 04 Jul 2025 16:22:28 GMT

Hi @JPavonM @hslai @Anthony O'Reilly

I have a ISE HA pair for PAN and a HA pair for MnT, trouble is they are the wrong way around and I need to swap the PAN and MnT persona roles at the failover 'B' site, as below:-

Question is service impact and process.

Process: Can I make the swap just in the GUI? Or do I have to de-register each secondary, reset them in console CLI with 'application reset-config ise’ and re-add them for a clean synch with their respective primary nodes?

Impact: When the persona swap is only with secondaries, will the primary reboot at any point?

Primary serve live AAA for campus wireless so if a reboot is on the cards I need to call it out and plan accordingly.

Many Thanks in advance for any advice on the above!

Tom