High Load Average on one Policy Nodes Due to Consistent Daily Spike

[vigandhi]

Hello All,  a major network traffic spike happening every day at the same time (business hrs) in one of the EMEA region. This spike is causing a huge load average on our PLOCY NODES in the EMEA. All other regions are good , INCLUDING Data centers where ISE NAC located. Is anyone aware of what might be causing this daily network event specifically in specific location ?  Any thoughts or suggested solutions are highly appreciated!

[Aref Alsouqi]

Usually ISE PSNs get overloaded when more users sessions are handled. Maybe you have a peak of users connecting to your network at that time of the day that is causing this specific PSN to be overloaded. One thing you could potentially do is splitting the load between the PSNs. If you don't have a load balancer in front, you could simply configure let's say half of your network devices (switches/WLCs) to point to this affected PSN as the primary RADIUS server, and then point to the next closest as the secondary server, and then the other half pointing to the closest PSN as the primary and to this affected one as the secondary.

[Ben Weber]

The answer to this question will likely require some more in-depth troubleshooting than anyone can give without knowledge of your network. 

How are you monitoring your network? Have you checked the RADIUS Live Logs to see if there are lots of users trying to authenticate to the network at the same time? Have you got NetFlow configured on your network, and if so, where are those logs collated?

Looking into these sources may help you find the root cause of your issue!