ise maintenance

[suthomas1]

Hello,

We have a distributed ise netork including 2 PAN with either of them acting as
primary/secondary monitoring node also & 2 Policy nodes. It has been running fine
for a while & we want to verify nodes again, as part of new program to be prepared
for unknown issues.this means, the nodes will be rebooted. All are vmwares.

ISE-PAN-A > Primary for administration & secondary for monitoring
ISE-PAN-B > Primary for monitoring & secondary for administration
ISE-PSN-A & ISE-PSN-B > Policy nodes

can someone please help to determine what order they should be rebooted.As also
any other suggestions/checks that should be used to make this smooth.

Thanks.

[Mark Elsen · Accepted solution]

 - You should have no issues rebooting the 4 nodes separately and  in the order you mention. Well that is supposing that your NAD devices  use the PSN's symmetrically and in 'failover' mode ! (no PSN is critical on it's own) (both are always used). Better also to not have policy-change work going on, on one of the admin nodes. Besides these low-profile issues, wait long enough between subsequent reboots and or issue via ssh show application status ise , to check wether a particular node is fully functional again.

M.

[suthomas1]

Thanks.
Is it more better to stop ise before the reboot & then start it again.
how can we ensure that there is minimal downtime doing the reboot. Is there
any particular order we should follow ?