ISE Mail Delivery is not working on 2 nodes, if one node is shut down

[mgollob]

Hello,
I am in the process of implementing an ISE Guest solution. I have 2 nodes for redundancy reasons. I send the approval and the credentials for the guests via mail.
I have 2 questions about this. If I shut down my primary node so that the backup node takes over, then the e-mail delivery no longer works. However, I can still access guests and the sponsor portal without any problems. Is there anything else to configure in the SNMP settings? If I go to the backup node and the primary node is still active and trigger the registration via the backup node, then the e-mail delivery works.

The other question would be, since I have two sponsor portals, because there are two ISE nodes and they have different IP addresses, I wanted to ask how I can make it so that the FQDN of the sponsor portal was always sent in the mail, on which ISE the self-registration was carried out? So for example guest registers on guestise01.example.com, then the link of the sponsor portal of sponsor.guestiese01.example.com should be sent in the approval mail. If the guest registers at guestise02.example.com, then the link of the sponsor portal sponsor.guestise02.example.com should be sent in the mail. I hope you know what I mean.

[ahollifield]

Are you promoting the secondary node to Primary Admin Node?  Or just shutting it down?  An active PAN is required for guest registration (this would include the guest email AFAIK).  Also note the limitations on a two node deployment when it comes to promoting secondary admin node to primary.  You may wish to consider a three node deployment or a medium deployment. https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Why do you have two sponsor portals?  You should only have one.  Use a DNS entry like sponsor.example.com that resolves to both PSN IPs.

[mgollob]

No, I do not promote the second instance as primary. The guest network should be set up redundantly. There is one ISE at each of the different locations. These ISE instances are in one deployment. Both IP addresses are entered as radius servers on the WLC. If I switch off an ISE instance, I am also redirected to the correct self-registration portal. That works so far. The guest can also register here and the request can be recognized and approved in the sponsor portal. I can't say whether I can then connect to the network when I click on approve in the sponsor portal and then get the credentials, I haven't tested it yet, but I think I can. The problem I have here is that no approval mails are sent out when a node goes down. According to your link, the guest access can also be found on the PSN and not on the PAN. I would just like to have redundancy in case an instance goes down, so that everything still works normally for the user.

I have two sponsor portals due to redundancy. I know that the portal runs on both instances. However, the problem is that several IPs can be assigned in the DNS, but these are processed in a round-robin procedure. In other words, if one instance fails, the DNS server usually doesn't notice because it has no health checks and could then forward the traffic to the wrong IP. For this reason, there are two portals. One points with the IP to one ISE and the other with the IP to the other ISE.

[Rich R]

> the problem is that several IPs can be assigned in the DNS, but these are processed in a round-robin procedure
Yes it's not ideal but clients handle this kind of setup all the time.  It'll take a short while to timeout the request if it selects the dead IP first but then it will switch to the second IP.  Hopefully failed ISE will not be a common occurrence!

[mgollob]

I also found an Answer describing, that the sponsor and guest notification will be send through the PSN. 

(https://community.cisco.com/t5/network-access-control/cisco-smtp-messages-sent-from-which-node/td-p/2902139)

[Greg Gibbs]

I suspect this point is moot considering, as @ahollifield also stated, there are various Guest-related functions that are not available when the Primary PAN is down. See the list of functions here - https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/admin_guide/b_ise_admin_3_2/b_ISE_admin_32_deployment.html#ID59

Among others, it specifically states that creation of New Guest accounts in not available when the Primary PAN is down.

I would suggest promoting the Secondary PAN to Primary and testing the Guest creation and email notification, as that is how the solution is intended to work.

[mgollob]

yes, if I promote the second node as primary, it works. Is there no way to do this automatically? It is not possible to install a third node. This is not a redundancy for me if I still have to intervene manually?

[Aref Alsouqi]

I don't believe it is possible to activate the auto-failover with a two nodes deployment.

[ahollifield]

You can enable PAN auto failover here (once you add a 3rd node).  Just note though, that services will restart on BOTH admin nodes when you do this so there will be a period in which ISE guest registrations and email notifications will be completely down.  This is why I always recommend a three node deployment (an additional PSN) or a Medium Deployment at minimum.  

[mgollob]

Is it possible for me to script it? Can I promote via the CLI or can I do it via the API?