Radius dead server with LB

[csavas]

Hi all,

I have a general design question;

is there a need at all to have a dead server configured on ISE if we have an LB in place?

What is the general recommendation?

Thanks,

Cengiz

[Ben Walters · Accepted solution]

It really depends on your ISE setup, if you only have one site where your ISE servers sit and they are all behind a LB for the services you don't have to worry about a dead server backup because the LB should determine if a server failed and remove it from the pool while the others still serve requests. 

However if you have 2 different sites each with their on set of ISE servers you could configure your devices to use one as the primary and the second as the dead server backup. This is how ours is setup, we have a main and backup datacenter which has 2 ISE pools behind LBs.

Unless of course you were using something like F5's GTM (Big-IP DNS) that does LB across the WAN. 

[paul · Accepted solution]

If your ports are in open mode you don't need the dead server config at all.  If you are in closed mode, you also have to think about the site losing access to the LB VIP.  It is unlikely that the VIP will be down, but what if the site loses access to the VIP for some reason.