Cisco ISE during reload will send disconnect message

[anilkumar.cisco]

Hello Team

We have planned a downtime.. and need to reload standalone ISE 2.7.2 version.

Just want to understand.. any live radius connection will drop during this time..

as we have some anyconnect client connected to the network via Radius..

Pls advise.

[balaji.bandi]

VPN Exisitng connection stay as it is  ( depends on config), new connection will not get through, since ISE down state.

if this ISE acting as device management, you not able to login  to any device using radius, but if you have fall back account to Local then you can use to login to end devices like Router and Switches.

[anilkumar.cisco]

i am bothering more about existing anyconnect connection..

what configuration you are expecting me to do so that existing anyconnect user will remain connected..

[balaji.bandi · Accepted solution]

I mean - once VPN clients connect, they stay as expected, some time idle time will disconnect the user, some setup automaticaally reconnect.

In this situation user authentication fails,since ISE off line.

Hope this make sense ?

[Mike.Cifelli]

Just want to understand.. any live radius connection will drop during this time..

-No.  I assume you authorize clients to the network and within the authz profiles or interface configs you have reauth timers deployed.  As long as clients are not attempting to auth to the network during the downtime there will be no impact on clients already connected to the network.  If possible I would suggest deploying additional ISE nodes as it aides with availability/load.  HTH!

[rschlayer]

All currently authenticated devices will stay authenticated until they hit the reauthentication timer or get logged of because of idle timeout.

While ISE reboots no new authentications can be made.