topic Re: HA after re-image in Network Access Control

HA after re-image

Saeed Abd Elhalim Hamada — Sun, 19 Jan 2025 09:35:13 GMT

i was have 2 node

ISE-1 << Prim(PAN) Prim (MNT)

ISE-2 << SEC(PAN) SEC(MNT)

after upgrade some thing happaned to the ISE-1 MNT and after talk with cisco we descided to Re-image the ISE-1

now ISE-2 is standalone

and ISE-1 standalone with no configuration yet only the licince

i need to know spefically what i will do to back the ISE-1 to the deployment please i need the step ....

Re: HA after re-image

Mark Elsen — Sun, 19 Jan 2025 11:21:40 GMT

@Saeed Abd Elhalim Hamada wrote : >...and after talk with cisco we decided to Re-image the ISE-1
You can use your contact with Cisco to ask for the needed steps too , for adding the (a) node to the deployment. The benefit being that you get an authoritative response,

Re: HA after re-image

Marcelo Morais — Sun, 19 Jan 2025 17:43:40 GMT

Hi @Saeed Abd Elhalim Hamada

1st Restore your CONFIG and OPER backup to ISE-1.

In Administration > System > Repository ... create your Repository

In Administration > System > Backup & Restore > Select the Repository, choose your Backup and click Restore.

2nd Change the ISE-1 Role from Standalone to Primary

In Administration > System > Deployment > select the Node > click Make Primary:

3rd Register the ISE-2 to the new Cluster.

In Administration > System > Deployment > click Register and enter the ISE-2 Data:

Note: what is your ISE version & patch ?

Hope this helps !!!

Re: HA after re-image

Ambuj M — Mon, 20 Jan 2025 02:52:08 GMT

re-image does not update patch, so make sure ISE 1 is on same patch as ISE2
Perform initial setup and install certificates to built trust between ISE 1 and 2
Promote ISE 2 to primary as suggested below
Register ISE 1 in deployment with required roles and wait for Sync.
make sure both nodes and Synced and veryfy AD status as well on ISE1.
make ISE 1 primary again.
take another backup (optional)

Re: HA after re-image

Saeed Abd Elhalim Hamada — Mon, 20 Jan 2025 11:06:27 GMT

Thanks @Ambuj M @Marcelo Morais all work done , but i have an iusse , i used certificate from Private CA and install the Root CA to ISE-1 and ISE-2 and i made Certificate Signing Requests for Both ise and this certifcate i used it form Admin , Auth etc as i show in the pic , but the massage service each one use selfsigned certifacte now i have problem with Queue Link Error so what is your suggestion to solve this problem ??

Re: HA after re-image

Marcelo Morais — Mon, 20 Jan 2025 15:32:41 GMT

Hi @Saeed Abd Elhalim Hamada ,

please take a look at ISE - Queue Link Error.

Hope this helps !!!

Re: HA after re-image

Saeed Abd Elhalim Hamada — Tue, 21 Jan 2025 07:41:02 GMT

Thanks @Marcelo Morais

i just rege the ISE ROOT CA and it`s working fine ♥

Re: HA after re-image

Marcelo Morais — Tue, 21 Jan 2025 13:43:45 GMT

Hi @Saeed Abd Elhalim Hamada ,

great news !!! I'm glad I could help !!!

Note: I hope you enjoyed the article: ISE - Queue Link Error, if you have any suggestion for improvement, just let me know !!!