Configuring and testing a failover scenario in Cisco Identity Services Engine (ISE) is an essential part of ensuring high availability for your network's authentication and authorization processes. While ISE doesn't automatically promote the secondary device to the primary in the event of a failure (like some other Cisco devices), you can perform manual failover testing to ensure that your secondary ISE node can take over smoothly. Here's a step-by-step guide:
1. Preparing for Failover Testing:
Ensure that your secondary ISE node is properly configured and synchronized with the primary node, including certificates, policies, and endpoints.
Confirm that both the primary and secondary nodes are reachable and operational before starting the test.
2. Live Log Monitoring:
Use the live log feature to monitor authentication and authorization events in real-time during the failover test.
Access the live log from the ISE web interface by navigating to "Operations" > "Live Log."
3. Initiating Failover Testing:
Simulate a failure on the primary ISE node. This can be done by stopping the ISE services or disconnecting the network connection to the primary node.
4. Observe Failover Behavior:
With the primary node intentionally unavailable, the secondary node should automatically take over the authentication and authorization tasks.
During this time, monitor the live log for any authentication requests and check if they are successfully processed by the secondary ISE node.
Pay attention to any error messages or issues that may arise during the failover process.
5. Testing Network Access:
Perform network access tests during the failover to ensure that users can still authenticate and access network resources.
If your network has redundancy at other layers (e.g., redundant switches), ensure that network connectivity is maintained during the failover.
6. Logs and Alerts:
Review the system logs and alerts generated by ISE to identify any issues or anomalies that may have occurred during the failover.
7. Failback Testing (Optional):
If desired, you can also test the failback process by restoring the primary node and ensuring that it takes over as the primary device seamlessly.
8. Document the Results:
Document the results of your failover testing, including any issues encountered, error messages, and the time it took for the secondary node to take over.
9. Remediation and Improvements:
If you encounter any issues or delays during failover testing, take steps to remediate them and improve your failover process. This may involve reviewing your ISE configuration, network design, and redundancy mechanisms.
It's important to perform failover testing during a maintenance window or during a period of lower network activity to minimize disruption to users. Additionally, make sure that all relevant stakeholders are aware of the testing and its potential impact on network access.
By following these steps and carefully monitoring the live log during failover testing, you can ensure that your secondary ISE node can effectively take over in the event of a primary node failure, maintaining network security and access.
