topic Hi Neno Spasov:You are in Network Access Control

ISE HA Deployment prerequisite issue.

xuekai zhang — Mon, 11 Mar 2019 04:48:00 GMT

I encountered this HA node deployment issue.Actually , I finished this feature with the enviroment of CA and DNS.However,Can I finish ISE‘s HA deployment without CA and DNS.

When I adding the second ISE node to the first one,I fill the blank with the second ISE's server IP address,the system notification indicates that Unalbe to authenticate xxx.Please check server and CA certificate configuration and try agian.

After that notification, I deploy the CA and DNS server.Also I signed the certificate and install the root CA for both ISE nodes,DNS records also be done.After that,I fill the blank with second ISE's FQDN and administration account .It can be done successfully.

So if my enviroment doesn't have CA and DNS.Does that mean I can't finish ISE'S HA function?

Any help or suggestion will be appreciated!

Hello-DNS: Your ISE nodes

nspasov — Mon, 16 Jun 2014 01:23:42 GMT

Hello-

DNS: Your ISE nodes must be resolvable via DNS before they can be registered in a "cluster." In fact, I think the DNS is also required before the install script would complete.

CA: On the other hand, a CA is not required. If you don't have a CA you can use the self-signed ISE certificates. You will need to import the self-signed certs to "Certificate Store" in ISE

Hope this answers your question(s)

Thank you for rating helpful posts!

Hi,You can not do ISE HA

abwahid — Mon, 16 Jun 2014 12:54:16 GMT

Hi,

You can not do ISE HA deployment without CA and DNS.

DNS : When you upgrade a complete Cisco ISE deployment, Domain Name System (DNS) server resolution is mandatory; otherwise the upgrade will fail.

CA : During the split deployment upgrade, before you register the nodes to the new primary Administration node, you must do the following:

-If you use self-signed certificate, you must import the self-signed certificate of all nodes to your new primary Administration node.

-If you use different CA certificates for the nodes, you must import all the CA certificates into the new primary Administration node.

-If you use the same CA certificate for the nodes, you must import that CA certificate into the new primary Administration node.

Hi Neno Spasov:You are

xuekai zhang — Mon, 16 Jun 2014 23:51:52 GMT

Hi Neno Spasov:

You are correct! So the CA enviroment is not must needed.However DNS record is a must be.

I want to rate your answer as the correct answer,but when I click the correct answer,the system indicate it's an invlaid answer,I'll try to find how to rate your answer as the correct answer.

Anyway Thansk!

Hi abwhaid:Thanks!Your replay

xuekai zhang — Mon, 16 Jun 2014 23:54:30 GMT

Hi abwhaid:

Thanks!

Your replay is helpful to me!

I can do ISE's HA with DNS enviroment,without CA server.

Glad I was able to help!

nspasov — Tue, 17 Jun 2014 00:00:44 GMT

Glad I was able to help! Thanks for the rating! 🙂

Hi abwahid:After the

xuekai zhang — Wed, 18 Jun 2014 08:07:05 GMT

Hi abwahid:

After the deployment can these two nodes work normaly withou DNS.

Can I finish this feature just through IP address,not in the method of FQDN.

Hi Neno Spasov:After the

xuekai zhang — Wed, 18 Jun 2014 08:08:23 GMT

Hi Neno Spasov:

After the deployment can these two nodes work normaly withou DNS.

Can I finish this feature just through IP address,not in the method of FQDN.