ise 1.3 psn redundancy

[Augustgood]

hi,

in my environment i have many remote site with one psn,  can be possible create for redundancy purpose a psn group with primary and secondary node and the remote psn? my problem ... the node are on different subnet..

[Marvin Rhoads · Accepted solution]

There are several options for PSN redundancy.

You can use a load balancer (with or without a node group), or just multiple PSNs with different NADs pointing to one or another as the first in the list the the less preferred ones listed as secondary, tertiary, etc.

As of ISE 1.3, node group members no longer need to be in the same subnet (or with TTL=2 reachability) but it's still a recommendation that they be withing the same high speed network for replication purposes.

So for your scenario, the latter method is probably indicated. Have a look at Cisco Live presentation BRKSEC-3699 and search for "NAD-based RADIUS Server Redundancy" for more details.

[Augustgood]

ok, i can use on my remote nad a local psn, if this fail the nad send request to other psn, i can use the primary node ? in my environment i have a primary node persona with admin and psn and monitoring backup.

[Marvin Rhoads]

Yes, that's correct.

WLCs and (by default) switch IOS will always use the first listed RADIUS server (PSN) and only fall back to the second one in the event of a failure.

IOS can optionally do RADIUS server load balancing at the NAD level. See this document (among others) for details.