ISE primary, secondary questions

[Steven Williams]

I am trying to cluster two ISE Nodes for primary and secondary.

I am not sure if the issues are related to the fact that each node has a different FQDN as in they don't have the same suffix. One is domainA.com and the other is domainB.com. I am not sure thats an issue since we have a cross forest trust. The primary is joined to the domain, the secondary is not. I have exported and imported the self signed cert from secondary and imported into primary. The sync is unsuccessful. Do I need to join the secondary to the domain joint point before registering secondary node?

[ognyan.totev]

Hi ,in old version of ISe like 2.1,2,2 you must import certificates manually or use wild card cerrtificate .In my deployment i use wiledcard certificate to all nodes and if i add new node to cluster i just add certificate to it

[ramkchel]

Could you please check the logs for deployment.log and replication.log from Operations>Troubleshoot>Download Logs>Debug logs of primary ISE UI.

This could help in checking what might have gone wrong.

[Steven Williams · Accepted solution]

Engaging TAC and it was an issue with my ISE version and the bringing it up to the latest Patch 10 fixed the issue. 

[Steven Williams]

Also some more info for anyone who wants to move from 2.2 to 2.3 or higher. This was the recommendation by TAC engineer. 

As of now, the recommended ISE version for non DNA-C integrations is actually 2.2 latest patch. If you do have DNA-C, the recommended would then be 2.3 latest patch. And we are not recommending to upgrade to ISE 2.4 yet unless you have a major reason to do so like some sort high impact bug that is only fixed on 2.4 or something like that.

If you do not really need to upgrade to 2.3, staying in 2.2 latest patch will be the recommendation.

[Jason Kunst]

Correct

[Steven Williams]

That is really good info to know. The one thing I do want to move to ISE 2.3 is the ability to give users read-only access to certain areas of the application. I don't think this is available in the 2.2 version. 

[Jason Kunst]

Also correct. Feel free to move to 2.3 if you’re needing that or you can wait until 2.4 is blessed as our official long term recommended release

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-740738.html