Status cannot be changed from mydevices portal on secondary PAN

[masyamad]

Hi dev team,

I tested MyDevice portal in 2 node deployment and found an interesting behavior.

I'm not sure it's expected or incorrect behavior. Could you comment on this?

When I modify device from primary PAN, both description and status can be changed.

ex) add description and change the status to "Lost"

 

* Attached xlsx shows full test procedure. Please also refer it.

 But when I did similar modification on secondary PAN, only description was updated.

Because it's secondary PAN, the result of status might be expected. (i.e. secondary PAN provides readonly access to registered MAC addresses).

But modification of description is still availabe even on secondary. So I'm not sure what the real expected behavior of mydevices portal is. Coud you confirm  about it?

[Nidhi]

Can you access My devices link from Secondary PAN ? You can only view limited options. 

Also, when you click on My devices portal from the PAN, the connection is to the PSN. you can check the address bar to confirm this.

Can you send me screenshot of your deployment page and the screenshot of your secondary PAN UI ? 

Thanks,

Nidhi

[masyamad]

Hi Nidhi,

It's not BYOD but mydevices portal issue. In my understanding, the portal will be accessed by not administrator but BYOD users. So it's accessed not from PAN GUI but accessed directly from web browser with a URL like https://mydevicestest01.testcert.com/ (or https://mydevicestest02.testcert.com/ for secondary ISE) which is definied in FQDN in mydevice portal setting page.

The snapshot of configuration page.

I don't believe it's related to PAN GUI...Do I miss something?

> Can you send me screenshot of your deployment page and the screenshot of your secondary PAN UI ? 

Yes.

Primary ISE

Secondary ISE

[Nidhi]

You can access it from the link - " Portal test url ' . which I thought what you did initially . 

I will test this and update you soon 

[Jason Kunst · Accepted solution]

My devices and all end user facing portals run on all the policy service nodes. To access it you would either use the portal test url or the easy url fqdn created under portal settings

When using the portal test url you would need to change the IP address in the string to access other PSNs as it only uses the first psn in the registered node list

To test using the fqdn you would need to add remove each psn node to dns respectively

Keep in mind that my devices should only point to a few PSNs max for redundancy in your ha scale design

The behavior you’re listing doesn’t seem correct. Would recommend working through tac to debug as the community is not meant for break fix determination

[masyamad]

Thanks for the confirmation. Unlike sponsor portal, I could not find expected behavior of mydevices portal on secondary node so would like to know if it's expected or incorrect behavior.

* Admin guides explains about "New Guest (Sponsored or Self-registered) " or "guest password change" but doesn't mention about "new device" or "device status change".
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_011.html#ID59

I understand it's incorrect behavior, will contact sustaining team for fixing.