How to enable Auto Pan Fail over?

[jakeraze]

Hi Sirs,

New to ISE. just want to know if how can we enable auto pan failover when we only have 2 ISE Device.

Thank you in advance.

[Mohammed al Baqari]

If its standalone deployment, then auto failover isn't support. For
distributed deployment, see this link.

*** remember to rate useful posts

[#Mat]

Hi. With two nodes, you can't enable auto-failover. You need, at least, three nodes. Two PAN and a PSN for the heartbeat.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010.html#reference_58F40B0E4D354B4DBB9940E4DB8DC8ED

Regards.-

HTH

[Damien Miller]

To be fair, no one should have a three node deployment if following the ISE best practices. You would have a four node hybrid, keeping psns dedicated.

If the third node was solely for health check, when the second PAN went to fail over, the 15 minute reload during automatic failover would cause an authentication outage.

[jakeraze]

Thank you all for your response. appreciate it.

Currently we set up this 2 ISE devices as Primary and Secondary. I though once Primary is down. my Network device won't authenticate unless i promote the secondary ise as Primary but i tried it on the lab and the result is even when it's on secondary state. my Switch can still authenticate. No need to promote the secondary to be primary at all.

We're only planning to use this ISE as authentication of our network devices and also for Meraki clients.

[Mohammed al Baqari]

Hi, it seems that you are using primary and secondary in standalone mode. Auto PAN not supported.

Also, you don't need to promote secondary to authenticate the endpoints when primary is down. What you need is to point your NAD devices to both ISE nodes (pri and sec). Then you can specify which node is the primary for each NAD when you add devices to ISE. Otherwise will be automatically selected. This way even if the primary goes down the secondary will automatically support. The benefit of selecting the primary node for each device is to make sure that profiling works fine.


**** remember to rate useful posts