Failback To Primary Server After X Minutes

[mykys]

Hi, 

We got two LDAP servers: primary and secondary:

What does Failback To Primary Server After X mites mean under the failover configuration?

Does that mean we always use the secondary server until it fails?

Thanks,

Myky

[Mike.Cifelli]

Here is an overview/description straight from Cisco docs:

-Cisco ISE supports failover between a primary LDAP server and a secondary LDAP server. In the context of LDAP authentication with Cisco ISE, failover applies when an authentication request fails because Cisco ISE could not connect to an LDAP server. Failover can occur when the server is down or is otherwise unreachable by Cisco ISE. To use this feature, you must define the primary and secondary LDAP servers, and you must set failover settings.

-If you establish failover settings and if the first LDAP server that Cisco ISE attempts to contact cannot be reached, Cisco ISE always attempts to contact the other LDAP server. The first server that Cisco ISE attempts to contact might not always be the primary LDAP server. Instead, the first LDAP server that Cisco ISE attempts to contact depends on the previous LDAP authentication attempts and on the value that you enter in the Failback Retry Delay box.

HTH!

[mykys]

Thanks and l did check the KB before posting here!

It's still a bit confusing, as both servers are up but most queries hit secondary.

Is Failback Retry Delay box different from the Failback To Primary Server option? 

Thanks,

Myky

[Mike.Cifelli · Accepted solution]

AFAIK no.  My understanding is that the failback timer will tell ISE when to try to use ldap svr1 again.  Have you confirmed that ISE thinks both are up during your testing? Have you tested with the other configuration telling ISE to always access ldap svr1 first, and reviewed your results?