Cisco ISE and receiving alarm between different ISE clusters

[r.westman]

We have two separate ISE clusters on the same subnet. When a certificate expire on one cluster we get a notification in the Alarm widget on both cluster. How does they know about each other? Are certificate expired alarms distributed by multicast? 

Thanks

[Damien Miller]

Two independent deployments, or two nodes joined in a deployment?

If there are two independent deployments, look in the logging menu at the remote logging targets. See if one deployment is pointed at the other as a remote logging target. I've never tried it myself, but the log collector might process correctly formatted ISE syslogs if they are sent. If so, possible denial of service avenue.

[r.westman]

It is two independent deployments and there is no Remote Logging Targets pointing to ip addresses in the other deployment.

[craiglebutt]

I have a similar issue not with certificates, but with some endpoints, my test lab is picking up devices, but the VLAN helper isn't pointing to LAB.

[hslai]

Since this not an easy matter, please engage Cisco TAC.