topic Cisco ISE in distributed edeployment , All PSN have same Policy sets ? in Network Access Control

Cisco ISE in distributed edeployment , All PSN have same Policy sets ?

palani2010 — Fri, 31 Jan 2025 15:55:03 GMT

Cisco ISE in distributed edeployment , All PSN have same Policy sets ?

Re: Cisco ISE in distributed edeployment , All PSN have same Policy se

Rob Ingram — Fri, 31 Jan 2025 15:56:29 GMT

@palani2010 yes, the PSN nodes in a distributed cluster would have the same policy sets.

Re: Cisco ISE in distributed edeployment , All PSN have same Policy se

owbhat — Sat, 01 Feb 2025 14:09:20 GMT

Yes, @palani2010
In a Cisco ISE distributed deployment, all Policy Service Nodes (PSNs) share the same Policy Sets because:

Policies are centrally managed on the Primary Administration Node (PAN) and then replicated to all PSNs.
This ensures consistent policy enforcement across all PSNs in the deployment.
PSNs are stateless regarding policies—they only apply the rules received from PAN.

PAN as Central Management in Cisco ISE

The Primary Administration Node (PAN) is responsible for configuration, policy management, logging, and reporting.
All changes made on PAN are pushed to other nodes (PSNs, Secondary PAN).
The Secondary PAN remains passive and takes over only if promoted.