ISE Distributed Node Registration Issue - "Registration Failed" Status

[zma]

I have a distributed ISE 2.0 deployment with 6 nodes (2 X PAN, 2 X MNT, 2 X PSN), there is no firewall in the middle. I have successfully added all 5 nodes into the PRI PAN and all the messages show successfully added for each of them.

However, after Sync, the Secondary PAN and PRI MNT's Node Status showing Yellow triangle and the "Registration Failed". The option "Syncup" is also disabled. All other 3 nodes show green square "Connected".

They have the same config and are added the same way. What could be the problem. Please help.

[jj27]

What version of ISE?

SSH to the CLI.  Can you ping each node from each other?

Are there forward and reverse DNS entries for all nodes?

Are the timezones for all nodes the same and is the NTP server the same and all node times synchronized?

[zma]

They are ISE 2.0. Network connectivity is all fine, ping or SSH no problem. I did miss DNS initially and ISE would not allow any node to be added without DNS. So I added DNS entries and they all got added successfully. But I do not have reverse DNS entries, not really sure if they are needed or not. They are all configured in the same timezone with same NTP servers. I will check the NTP status tomorrow.

[Jatin Katyal]

If you have NTP and other basic stuff configured fine. You can quickly reload the Secondary PAN and PRI MNT. We could have looked at the logs but I'm sure the replication logging components were not set to DEBUG level.

~ Jatin

[jj27]

It's required for those DNS entries to be there. Not sure it is your problem, but definitely required.

http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_010.html#ID209

Configure the Reverse DNS lookup for all Cisco ISE nodes in your distributed deployment in the DNS server. Otherwise, you may run into deployment related issues when registering Cisco ISE nodes, and restarting Cisco ISE nodes.