Cisco ISE version 1.2.1.198 distribution deployment issue

[Rajib Das]

Dear All, I am having 3 ISE (Admin, PSN & MNT node) running on version 1.2.1.198 with no patch. My MNT node is not sync. with admin node. I need to apply a certificate but getting error. I am unable to deregister it. I have tried to push the patch 3 by installing same on Admin node but it is not getting push to either MNT or PSN node. I am attaching the screen-shots for your reference. Please let me know if you need any input from my side.

[nspasov]

What happens when you try to de-register that node from the deployment? Also, do you have HTTP/CLI access to it?

[Rajib Das]

I am unable to de-register that node from the deployment. I have HTTP & CLI access to it.

[nspasov]

What error do you get when you try to de-register it? Also, from CLI issue this command and post the results here:

show application status ise

[Rajib Das]

I am attaching both the de-register error screen-shot , & command output.

[nspasov · Accepted solution]

You must first configure another ISE node to run the "Monitoring" persona before you can de-register that node. An ISE deployment requires at least 1 admin and 1 monitoring persona. So for instance, you can go to your admin node and enable the monitoring persona and then try de-registering that node again. 

I hope this helps!

Thank you for rating helpful posts! 

[Rajib Das]

Hi, I have made PSN as monitor Primary, then de-registered the Monitor node & registered it back & made it monitor primary. Now all nodes are syncing properly. But after this my call flow is breaking. All user request are going for default deny, i.e. access reject & drop. Earlier it was working properly, users were able to connect / authenticated & authorized also access the websites properly. Earlier only monitor node was not syncing , but now although it is syncing but call flow is breaking & there is no change in configuration. I have updated the ISE version 1.2.1.198 with only a patch , i.e. patch 3 on all 3 nodes i.e. admin, PSN & monitor. Please suggest also let me know incase you need more info.

[nspasov]

Hi Rajib, this sounds like a new issue that I would recommend that you start a new thread for with additional info: screenshots, requirements, etc and close this thread since your original issue was resolved. 

[Rajib Das]

Hi Neno, Thank you...