topic Re: Secondary ISE auth requests in Network Access Control

Secondary ISE auth requests

manvik — Mon, 04 Apr 2022 06:58:07 GMT

Can secondary ISE serve any authentication requests? Current setup is primary ISE at DC and secondary ISE at DR.
Testing anyconnect VPN via DR. Since DR ISE is in a secondary role, can it server the authentication requests from DR ASA.

Re: Secondary ISE auth requests

Rob Ingram — Mon, 04 Apr 2022 07:36:37 GMT

@manvik I assume these ISE nodes part of the same cluster? If so, then as long as the secondary node is running the PSN persona then yes it can authenticate requests from the DR ASA. It's the configuration of the ASA which is configured with the PSN and which PSN to prefer.

Re: Secondary ISE auth requests

manvik — Mon, 04 Apr 2022 08:47:40 GMT

yes, ISE nodes are part of same cluster. currently the authentication is not working, can DR ISE logs viewed from DC ISE in same cluster.

Re: Secondary ISE auth requests

Rob Ingram — Mon, 04 Apr 2022 10:25:59 GMT

@manvik Yes, you should be able to see the authentications in the DC ISE Logs. DC/DR are part of the same cluster, the Primary MnT will log traffic for any PSN in the cluster, regardless of where it is physically located.