topic Re: Cisco ISE failover test in Network Access Control

Cisco ISE failover test

M Talha — Thu, 10 Apr 2025 06:13:31 GMT

Hi Community members,

I have to test failover between ppan and span. what should be the process to test failover ? I have distributed deployment where both ppan and span are in different data centers.

Regards,

Re: Cisco ISE failover test

Arne Bier — Thu, 10 Apr 2025 22:07:51 GMT

ISE Admin Node failover happens when you promote the current Standby node to Primary. You can't demote the current Primary.

Browse to the Secondary Admin node and click the Promote button.

At that point, both your Admin nodes will be out of service for a while. The old Primary is restarting and becoming Secondary, and the old Secondary is restarting services to become the new Primary.

If you have MNT and PSN nodes in the network, those will be unaffected during this time. You just won't have any admin GUI to monitor or make any changes.

The other small caveat during this promotion stage, is that Guest account creations won't work - you Guest Portals (running on PSN) will display and allow login etc. - but Sponsor portal won't create new accounts because you need a Primary Admin node to be fully operational to store the data in the master database.

Re: Cisco ISE failover test

kailandrew60 — Tue, 15 Apr 2025 18:46:38 GMT

To test failover between PPAN and SPAN in a distributed deployment, start by simulating a failure on the PPAN, such as shutting it down or disconnecting it from the network. Observe whether the SPAN automatically takes over operations without service disruption. Monitor system logs, alerts, and overall behavior to ensure a smooth transition. Once verified, bring the PPAN back online and check that it properly re-syncs with the SPAN and resumes its role without issues.
A2game

Re: Cisco ISE failover test

Marcelo Morais — Sat, 12 Apr 2025 14:15:46 GMT

Hi @M Talha ,

1st the basics ... ISE supports automatic failover for the Administration Persona, but:

it is disabled by default
does not support automatic fallback to the original Primary PAN
requires at least 3x Nodes (2x assuming the Administration Persona and 1x the nonAdministration Persona)

2nd before testing failover between PPAN and SPAN, please take a look at: Cisco ISE Administrator Guide, Release 3.4 - Deployment of Cisco ISE, search for:

Support for Automatic Failover for the Administration Node
High Availability for Administrative Node
High-Availability Health Check Nodes
Automatic Failover to the Secondary PAN
Sample Scenarios when Automatic Failover is Avoided
Functionalities Affected by the PAN Automatic Failover Feature
Configure Primary PAN for Automatic Failover

3rd testing failover ...

If your Deployment doesn't have automatic failover, please take a look of what @Arne Bier said earlier

If your Deployment have automatic failover, please take a look of what @M Talha said earlier

Hope this helps !!!

Re: Cisco ISE failover test

M Talha — Mon, 14 Apr 2025 06:53:52 GMT

Thanks a lot @Arne Bier for the brief explanation. I have able to test failover successfully without any issues.

Regards,

Re: Cisco ISE failover test

Saeed Abd Elhalim Hamada — Mon, 14 Apr 2025 17:23:12 GMT

it depend you enable automatic failover or not , if you enable it you can go the the PPAN and stop all service from CLI (application stop ISE ) and after while the failover should be triggered , if you not enable it then you need to make it manually be go the the SPAN and promote it to Primary