topic 2 ISE Deployments on same network, different versions in Network Access Control

2 ISE Deployments on same network, different versions

craiglebutt — Fri, 25 Nov 2022 08:50:17 GMT

Last year upgraded our deployment from 6 PSN on 2.2 to 4 PSN on 2.7, this was due to 2 PSN being hardware and couldn't upgrade.

1 of the 2 PSN on 2.2 I turned in PAN, so could be used as a LAB. Enable them yesterday to test a feature but noticed that the PSNs on 2.7 were sending data to the PAN on 2.2.

When I upgraded the Deployment in the first time, I built new nodes, and restored the data, but I did give those nodes the same IP and DNS.

The 2 old nodes are not part of this deployment, and the new nodes are not part of the old deployment.

These deployments should not even know about each other.

How is this?

Cheers

Re: 2 ISE Deployments on same network, different versions

balaji.bandi — Fri, 25 Nov 2022 12:29:25 GMT

if they are different deployment, i do not see the reason why they are sending data to Pan.

Re: 2 ISE Deployments on same network, different versions

thomas — Wed, 14 Dec 2022 00:33:50 GMT

If you restored the configuration which contained the old nodes in a deployment, it still thinks they are in the deployment. Remove them from the PAN and all should be good.

Re: 2 ISE Deployments on same network, different versions

craiglebutt — Fri, 27 Jan 2023 10:14:00 GMT

hi, I did restore, but the old PSN don't appear in the new PAN.

Plus the 2 old PSN, 1 I changed to a PAN and that is what is seeing the traffic. In the old config, that PSN was never a PAN

cheers

Re: 2 ISE Deployments on same network, different versions

Marcelo Morais — Sat, 28 Jan 2023 06:01:10 GMT

Hi @craiglebutt ,

when you said " ... but the Old PSN don't appear in the New PAN ... ", please use the following command to check who is the PAN:

ise/admin# show tech-support
...
*****************************************
Displaying ISE deployment ... 
*****************************************
Node Config Details

NAME PERSONA ROLE ACTIVE REPLICATION
------------------- --------------- ---------- ---------- ---------------
<MnT Hostname>      MNT             SECONDARY  ACTIVE     SYNC COMPLETED
<PSN Hostname>      PSN             SECONDARY  NONE       SYNC COMPLETED
<PAN Hostname>      PAN             PRIMARY    NONE       Not Applicable
...

Hope this helps !!!