ISE1.1.3 failover problems

Amit Singh2000 · ‎04-17-2013

Hi guys

I am going to write a short story and will try to explain the problem I have.

Here is my setup. I have two ISE servers running I. Primary and secondary mode. Ise1 and ise2. Everything is configured and sync is complete. My access switch is a 2960 which has dot1x enabled and radius defined in the Config. It's using ISE 1 as primary and ise2 as secondary point of authentication. There are phones connected to switch and PCM behind the phone.

The phones and pc authenticate using EAP-TLS which works fines when both servers are up and running. Printers use mab and video end points use EAP-PEAP. All good till here.

When I shut down my primary server , phones printers and video endpoints authenticate without any problem. Pc is having issue and I am getting error message saying EAP timeout after120 seconds.

Today just to test that ise servers are configured properly. I removed the primary server from 2960 Config. Now switch has only one radius server listed for authentication. Which is ISE 2. The authentication works fine. All of them. Then I shut down ise1 just for the sake of it. At this step I have ise2 running and 2960 switch has only one radius configured. Everything works fine here.

The minute I add ISE 1 as primary radius server pc authentication fails and I get EAP time out message.

Looks like I have to tweak some configuration on 2960 so that it failover to backup ISE ASAP. Has anyone seen that ?

Thanks.

Sent from Cisco Technical Support iPad App

Ryan Wolfe · ‎04-17-2013

If you have the radius-server commands put in, the switch should just rotate through the servers if they're not available. But, there are radius server groups and the traditional radius-server host commands. Could just be something was overlooked.

But, this does seem to be a problem with switch configuration. Can you provide the config of the 2960?

ryan.lambert · ‎04-17-2013

Do you have the following lines in your config?

radius-server dead-criteria time 5 tries 3

radius-server host auth-port 1812 acct-port 1813 test username radius-test key 7

I could see a situation where you have the aaa server group configured, but not this, and your switch failed to identify the primary RADIUS server as down, forcing the issue of manual removal.