topic Re: Node not able to join deployment in Network Access Control

Node not able to join deployment

NetworkMonkey101 — Wed, 13 Nov 2024 16:32:15 GMT

I am unable to join a node to the deployment even though I am able to ping PAN to new node and vice versa? What could be stopping this?

Re: Node not able to join deployment

Rob Ingram — Wed, 13 Nov 2024 16:35:07 GMT

@NetworkMonkey101 is DNS setup and working? Can you ping the FQDN?

Re: Node not able to join deployment

Dustin Anderson — Wed, 13 Nov 2024 16:36:20 GMT

I would check this guide that the ports are open between the nodes for all communication.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/install_guide/b_ise_InstallationGuide30/b_ise_InstallationGuide30_chapter_7.html

Re: Node not able to join deployment

ahollifield — Wed, 13 Nov 2024 17:11:26 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/3-4/install_guide/b_ise_installationGuide34/b_ise_InstallationGuide_chapter_7.html

Re: Node not able to join deployment

dalbanil — Wed, 13 Nov 2024 18:25:34 GMT

As mentioned check the DNS, can you resolve from node a to node b with the command nslookup nodea.domain.com ? And also from node a to the node b? Finally, I'd highly recommend collecting a packet capture. Use the following documentation, it includes the ports for replication and synchronization:

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/install_guide/b_ise_InstallationGuide30/b_ise_InstallationGuide30_chapter_7.html

Replication and Synchronization

HTTPS (SOAP): TCP/443
Data Synchronization/ Replication (JGroups): TCP/12001 (Global)
ISE Messaging Service: SSL: TCP/8671
ISE internal communication: TCP/15672
Profiler Endpoint Ownership Synchronization/ Replication: TCP/6379

Re: Node not able to join deployment

Aref Alsouqi — Thu, 14 Nov 2024 11:48:22 GMT

You seem to have a firewall in between these two ISE nodes. Just make sure please that you have all the required ports opened as mentioned by the others, or you can open up all the ports between these nodes on the firewall if they are in segregated secured segments and then look at the firewall logs to narrow down the policy based on the utilised ports you see on the logs.