topic Re: Forcing an ISE node into stand alone mode in Network Access Control

Forcing an ISE node into stand alone mode

pmcternan — Tue, 20 Feb 2024 13:55:50 GMT

I am in the process of standing up 6 new SNS-3755-K9 servers. They are running 3.1 software. I just did a back up/restore on the new environment from our production in order to get a lot of the configuration stuff done. When the nodes came back up I changed the PAN from stand alone to primary. When I tried to register my other 5 nodes I got an error saying "Node is not a Standalone node". All indications are they are stand alones and there is no option in the GUI to make the other 5 stand alone. Do I need to reboot them? Is there an option in CLI to make them stand alone so I can register them?

Thanks in advance.

Re: Forcing an ISE node into stand alone mode

thomas — Tue, 20 Feb 2024 16:52:29 GMT

By default, all nodes are Standalone upon installation.

Did you restore to only the PAN or all of the nodes? Restoring to each node might be the problem.

Re: Forcing an ISE node into stand alone mode

pmcternan — Tue, 20 Feb 2024 17:03:27 GMT

I registered all the nodes in the primary PAN's GUI prior to doing a config restore. When I did the restore the primary PAN came back up as a standalone with all the personas. I changed the PAN from stand alone to the primary and then attempted to register the other 5 nodes as MnT's, PSN's and a backup PAN. That's when I received the error from the nodes I am attempting to register: "Node is not a Standalone node". The problem is I don't have an option to make the other 5 nodes standalones on their GUI as the GUI is very limited in the actions you can take. Do I need to default/restore them from the CLI for each node?

Re: Forcing an ISE node into stand alone mode

Marcelo Morais — Tue, 20 Feb 2024 20:15:44 GMT

Hi @pmcternan ,

1st remember that you just need to restore the Config Backup on one Node (the future Primary PAN), the others 5x Nodes just need to have a fresh install (same Version & Patch of the future Primary PAN), after that every time you register a new Node the Primary PAN configuration will be sync with the new Node.

2nd please try the following CLI on the other Nodes

ise/admin# application reset-config ise

This node is part of the deployment. It is recommended you first deregister this node from the deployment before resetting the configuration. Proceed with factory reset? (y/n): Y
Leaving currently connected AD domains if any...
Please rejoin to AD domains from the administrative GUI
Smart Licensing is Not Enabled. Not possible to Disable.
Retain existing Application server certificates? (y/n): Y
Reinitializing local configuration to factory defaults...
...

Hope this helps !!!

Re: Forcing an ISE node into stand alone mode

pmcternan — Wed, 21 Feb 2024 14:37:44 GMT

Thank You Marcelo. If I reset them from the CLI using the application reset-config ise command will they lose their FQDN, IP address certificate and username and PW? Will I need to console in and redo all of that when it comes back up? Thanks in advance.