https://community.cisco.com/t5/network-access-control/secondary-node-not-synced/m-p/5013832#M587118 <P>Yes, you can deregister a node that is not synchronized or reachable. You could then reset the failed node from the CLI using the 'application reset-config ise' command to rebuild it, import (if you saved the private key) or re-generate the Admin cert for the node, and register it back to the Primary PAN.</P> Wed, 07 Feb 2024 00:51:09 GMT Greg Gibbs 2024-02-07T00:51:09Z https://community.cisco.com/t5/network-access-control/secondary-node-not-synced/m-p/5013787#M587115 <P>Hello</P> <P>We have an old ise 2.7 deployment with 2 notes.</P> <P>The PPAN is fine but the Secondary is out of sync since along time.... (several months)</P> <P>Looks they can not communicate anymore. We need of course to check dns, ntp , certs and network connectivity....</P> <P>In case everything is fine with the above options but still not in sync, is it possible to deregister/remove the secondary from pan and reset the secondary from scratch? I mean can we dereguster the span if it is un reachable from pan?</P> <P>&nbsp;</P> <P>Regards</P> <P>&nbsp;</P> Tue, 06 Feb 2024 21:53:37 GMT https://community.cisco.com/t5/network-access-control/secondary-node-not-synced/m-p/5013787#M587115 REJR77 2024-02-06T21:53:37Z https://community.cisco.com/t5/network-access-control/secondary-node-not-synced/m-p/5013832#M587118 <P>Yes, you can deregister a node that is not synchronized or reachable. You could then reset the failed node from the CLI using the 'application reset-config ise' command to rebuild it, import (if you saved the private key) or re-generate the Admin cert for the node, and register it back to the Primary PAN.</P> Wed, 07 Feb 2024 00:51:09 GMT https://community.cisco.com/t5/network-access-control/secondary-node-not-synced/m-p/5013832#M587118 Greg Gibbs 2024-02-07T00:51:09Z