cisco ise has two primary active pan nodes

[Comtrackllc]

Dears,

I deployed distributed ise nodes with five nodes.

The two nodes are pan and three nodes are psn.

but now I have two primary active pan and I can`t remove any of them.

May you please help me to remove one of them or change it to secondary pan.

[Sheraz.Salim]

You need to do ISE Node Deregistration. To remove a node from a deployment, you must deregister it. When you deregister a node from the Primary PAN, the status of the deregistered node changes to standalone and the connection between the primary and the node will be lost.

than you have to re-register again and you can check in the option set as what you want this node as.

just looking carefully seem like you having a split brain. your both nodes are Primary. having said that. bear in mind if you change the status of primary node to secondary it will restart the services.

ISE-P need to be a secondary node in your setup.

have a look on this link. https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html#wp1053327

[Comtrackllc]

Thanks for the support.

But when I select the pan node in the deployment page, deregister option change to gray and cannot select.

 

[Sheraz.Salim]

This could be a lengthy process. I assume if this is a virtual setup you can power off the one node which you like from these two Primary nodes or you go to CLI of any these two nodes and give command config application reset ise. this command will reset the ISE node into its default setup wipe off everything from this node. but i suggest you to do the power off method. spin a new vm with ISE and register it as a secondary Admin node. once this done  and register as a secondary node you can delete the one ise you put off earlier.

unless you have a TAC support open case with them.

[Aravind Ravichandran · Accepted solution]

Hello,

Even if you power-off the vm, the PAN entry will be there in PSNs and other node as Primary node.Am afraid if you even power off the vm it won't allow you to deregister it from the deployment as it was registered as primary node.

Also when 2 Admin node is already exist in a deployment, you can't introduce a third PAN in it.

Please contact TAC, they will change the node value as secondary admin in DB on all the nodes.

[Sheraz.Salim]

@Aravind Ravichandran

thanks you this was very useful information.