In the case where you only have two ISE nodes, and each one of them is enabled for TACACS Service, then the solution is simple. On your NAS/NAD devices you simple configure ISE1 as primary and ISE2 as secondary. You can of course be more creative than that, and load balance the requests across both ISE nodes to get your value for money! e.g. any NAS device with an even IP address goes to ISE1 and the odd IP addresses go to ISE2 - or whatever. You get the idea. Just be careful with this primitive load balancing methodology - if you are not careful you could cause an imbalance in the loading of one of the ISE servers. And also remember to ensure that if either ISE server fails, that the remaining server can handle the load. If you want this kind of deterministic behaviour, then go for the idiot-proof method of sending all Primary TACACS requests to ISE1 and secondary to ISE2. Your NAS will decide when to use one or the other, depending on health checks.
Regarding 802.1X - when you install the servers, just install the same certificate on both servers for the EAP role. They don't need to be different certificates. Put both server FQDN's into the SAN (see below).
Same goes for the Admin role cert - make one cert with the same Subject Common Name, and then specify you ise01.mycompany.com and ise02.mycompany.com in the SAN (Subject Alternative Name). This ensures that your web browsers can trust both servers, no matter which one you are browsing to.
Hope this helps.
