topic Re: Admin certificate replacement in 4 nodes deployment in Network Access Control

Admin certificate replacement in 4 nodes deployment

REJR77 — Thu, 28 Nov 2024 16:25:54 GMT

Hi,

We have changed the admin certificates on a 4 nodes ISE deployment. (1PAN, 1SPAN, 2PSN with v3.1)

We performed the operation in the following order: PSN1, PSN2, SPAN, PAN, waiting each time for the services to be up.

When changing Admin cert on the PAN (last node of the maintenance window) we observed that each node restarted one more time

I don't remember that in the past, is that the expected behaviour?

thanx

Re: Admin certificate replacement in 4 nodes deployment

Flavio Miranda — Thu, 28 Nov 2024 17:21:28 GMT

@REJR77

Expected according to this CSCut10928

Re: Admin certificate replacement in 4 nodes deployment

REJR77 — Thu, 28 Nov 2024 17:17:06 GMT

@Flavio Miranda Such and old bug... Do you think it is still not fixed?

Re: Admin certificate replacement in 4 nodes deployment

Flavio Miranda — Thu, 28 Nov 2024 17:20:55 GMT

I believe you just proved not LOL. Just kidding but last update on the Bug was March 2024. chances are they are sitll there.

Re: Admin certificate replacement in 4 nodes deployment

REJR77 — Thu, 28 Nov 2024 17:24:39 GMT

Yes, you are right.... 😀

In environment where there are only 2 nodes it can be a little annoying

Re: Admin certificate replacement in 4 nodes deployment

Flavio Miranda — Thu, 28 Nov 2024 17:29:59 GMT

No fix release yet. The Bug is up and running.

Re: Admin certificate replacement in 4 nodes deployment

Arne Bier — Fri, 29 Nov 2024 03:51:47 GMT

I tend to always leave the PPAN till last - and before updating it, I promote the SPAN to Primary - it will restart both Admin nodes, but at least the PSNs keep running. The idea is to avoid updating the Primary admin node - you can then promote the Standby back to Primary and then you are back where you started.