topic ISE distributed deploy in Network Access Control

ISE distributed deploy

Kasper Elsborg — Sat, 30 Sep 2023 08:43:18 GMT

Hi Guys, I am a bit puzzled about this. I have implemented 2 ISE nodes in Simple Two Node Deployment. Each node holds all personas. If I split it up, Ise03 holds, Admin and MnT, and Ise02 holds PSN personas, It still works, and clients gets AuthZ. NAD tacacs+ also works, however the live logs are empty?

Any ideas?

Both servers has certifcate from MS AD, NTP are in sync, and DNS records are in place.

Regards Kasper

Re: ISE distributed deploy

balaji.bandi — Sat, 30 Sep 2023 09:16:15 GMT

what version of ISE - I am bit confused here, you mentioned 2 Node deployment, do you have 3rd node admin and Mnt ?

The Live Logs you looking hope Operations > TACACS > Live Logs

what switch model ? (may be run some debug and check is the logs shipping to ISE)

Re: ISE distributed deploy

Kasper Elsborg — Sat, 30 Sep 2023 13:12:11 GMT

Hi @balaji.bandi First it's a test lab that I have running. The deployment was as described ISE02, and ISE03, holding all personas, PSN, MnT and Admin. Everythin works, Radius, and Tacacs, and there are logs in both Operation->live logs, and operations->tacacs->livelogs. and ofcause my policy sets get hits. Then I split deployment up, and ISE03 now only has admin and MnT, and ISE02 now only has PSN. Everything works like before. Clients get dot1x authZ and there are hits in the policies, Tacacs works, however now there are no logs in any of the live logs.

ISE 3.1.0.518 patch 7

Switch is a WS-C3650-48PD

Br. Kasper

Re: ISE distributed deploy

Kasper Elsborg — Sat, 30 Sep 2023 17:08:00 GMT

Hi, So I've disabled the "Use "ISE Messaging Service" for UDP Syslogs delivery to MnT" and then I have livelogs again. Then I reissued certificates for ISE Messaging Service on both node, but using the pxgrid template(it has both server and client). Reenabled the ISE Messaging Service" for UDP Syslogs delivery to MnT, and now it works.

Re: ISE distributed deploy

balaji.bandi — Sat, 30 Sep 2023 18:02:21 GMT

glad to know all working, cheers for sharing your solution.