sponser redundancy two PSN- no load balncing

[mhm_ameen]

Hi,

we have two PSN and we configure certificate to include spnonser.mydomain.com , and under portal setting we configure FQDN for the portal to be spnonser.mydomain.com , now if we configure A record for spnonser.mydomain.com to use primary PSN its working and if we change A record to point to secondary PSN portal is not working so is this expected behavior or i should be able to open portal from both PSN. 

[ahollifield · Accepted solution]

You should be able to open the sponsor portal to any PSN that has the correct portal certificate tag present.  What exact error do you receive when conning to secondary PSN?

[Arne Bier]

Yep - an error condition would be useful.

And also when testing this, ensure that the DNS is resolving to the IP address you expect (i.e. you might need to flush the DNS cache on your test host after changing the A record on the DNS server)

As @ahollifield also pointed out, a valid portal cert must be assigned to each PSN.

I just tested this in my setup and it works on both nodes. Although in fairness, these are all-in-one-nodes (PAN/MNT/PSN). I don't have a dual standalone PSN setup to test with at the moment. But I don't see why this wouldn't also work there.

NB: The biggest challenge with Sponsor Portal not working is that the Primary Admin node MUST be operational for the Sponsor Portal to work. So if you killed off your PAN as part of the test, then swapping the DNS to the other PSN won't work, because PAN is dead. Yes you can launch the web portal login page successfully, but your logins will be refused. See below:

[mhm_ameen]

sorry, its not working on both PSN itw working only if i keep portal by IP address and not name if using name like sponser.mydomin.com its not working and through certificate  HSTS error. we used 3rd party SAN certificate and include each ISE PSN as SAN in addition to sponser.mydomin.com but not working .  what i notice is that when certificate  HSTS error showing and click on certificate detail its using PAN admin certificate despite am using dedicated portal certificate. is this mean PAN admin certificate should include SAN for sponser.mydomin.com as well . if yes why since  my admin PAN certificate is internal CA and i want 3rd party certificate for my sponsor.

[Aref Alsouqi]

Before you land into the sponsor portal the session will first go to the PAN, and then the PAN redirects that session to the sponsor portal. This is why you actually see two certificates presented if you inspect this flow, one would be the PAN cert and the other is the one you tied to the sponsor portal. I think this is a design decision on ISE.