05-13-2012 11:48 PM - edited 03-10-2019 07:05 PM
We are setting up lab where we have installed 2 ISE on VM. We are deploying them in HA mode. While deploying them we are facing error after registering ISE-2 with Primary ISE-1. Even after periodic refresh of 'Sync' tab we are getting 'out of sync' Error.
We have checked certificate which is bound correctly as we could register ISE-2 under primary ISE-1
TIme: Time on all the devices are synched up properly and are in UTC timezone.
What are the factors that play role for HA in ISE. Which things has to look upon while resolving the error.
---Securview Support
05-14-2012 07:11 PM
Please check if ISE-1 resolves the hostname of ISE-2 and viceversa. You should check if both hostnames are in your DNS server.
PLease rate if it helps
05-14-2012 10:26 PM
Hi Eduardoaliaga,
Thnaks for your reply. The answer to your question is yes, they are abe to resolve the hostname of eachother. ISE 2 has registered in ISE 1, but ISE 2 is not able to sync up with ISE 1.
05-16-2012 01:31 PM
How long did you wait after you saw this error? Also it can take some time (up to 20 minutes) before the nodes are fully registered.
If you issue "show application status ise" on the secondary node, what services are on? Also what personas are these nodes running?
Thanks,
Tarik Admani
05-20-2012 12:57 PM
Based on personal experience, I would say make sure the domain-name for both VM is the same. For example
vm1.ad.abc.com and vm2.dir.abc.com (VM1 & VM2 as hostnames and ad.abc.com & dir.abc.com as domain names) didn't sync up during my testing with ISE 1.0 last december. The secondary VM will register with primany but wouldn't sync-up.
05-20-2012 01:11 PM
Prerequisites before Registering Secondary Nodes
http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.html#wp1136385
Regards,
Jatin
04-24-2013 04:03 PM
Hello,
Please cross check your configuration with the below link. I hope this might help you in this.
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html#wp1128454
05-15-2013 11:01 PM
Hello,
I went through your query and found some pre-requisite which would help in solving your query:-
Ensure that you have a second ISE node configured with the Administration persona before you can promote it to become your primary Administration ISE node.
•Before you configure the Administration ISE nodes for high availability, we recommend that you obtain a backup of the Cisco ISE configuration from the standalone node that you are going to register as a secondary Administration ISE node.
•Every ISE administrator account is assigned one or more administrative roles. To perform the operations described in the following procedure, you must have one of the following roles assigned: Super Admin or System Admin. See Cisco ISE Admin Group Roles and Responsibilities for more information on the various administrative roles and the privileges associated with each of them.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide