Cisco ISE: Impact of making node "Primary" from Standalone

[Brett Verney]

Hi all,

I have a Cisco ISE node running in Standalone mode, and I'm planning to move to a Distributed deployment. I need to promote my existing node to Primary by clicking "Make Primary" in the deployment settings.

Customer operates 24/7 - so my concern is whether this action will cause any authentication disruptions for clients using RADIUS. If so, for how long approximately? It's been a while. 

My memory eludes me!

-Brett

[Arne Bier]

Hey @Brett Verney 

For sure, your application processes will restart. I have not done this exact operation in years, but it takes around as long as any application restart takes.  There might be a bit of extra downtime as the database gets updated etc. to Standalone.  It's a bit of an upheaval. But all services and the web UI will be unavailable.  

[Aref Alsouqi · Accepted solution]

I don't believe ISE services will be restarted when you click on "Make Primary" of your standalone node, at least that is what I saw in a lab I ran back in 2019:

https://bluenetsec.com/adding-a-secondary-ise-node/

[Arne Bier]

Aref is right. To Make Primary is not service impacting, but I saw the screenshot that said Make Standby, hence my reply. Which is it?

[Brett Verney]

Thanks guys,

Oops sorry - epic screenshot failure. Definitely meant "Make Primary" not standalone or standby. You were right - clicking "Make Primary" took a few seconds and wasn't impacting at all.

I switched the primary node to standby once the cluster formed and this was impacting, but only for new authentications. Lots of services were restarted on both nodes - but mostly on one appliance at a time.