What happens when ISE Primary Admin node (and Secondary Admin node) are down?

[dazza_johnson]

Hey there, first of all a quick acknowledgement that of course you make sure the ISE Admin nodes are highly available.....

However, what actually fails if both the Primary Admin node (and Secondary Admin node) are offline for say 15 minutes? In my (non-scientific) test when I rebooted the Primary Admin node (and Secondary Admin node) the authentications to the PSNs continued to work from what the users told me.

My initial conclusion is that you lose the ability to manage the ISE deployment (configure or monitor it) but that the authentications continue to work. This seems too simplisitic, is there anything official on this as to what works/doesn't work when the Primary Admin node (and Secondary Admin node) are down?

Thanks

DJ

[Charlie Moreton · Accepted solution]

If both Admin Nodes are down, the services affected are (I know the table states the Primary is down and the secondary has yet to take over.  In this situation, both nodes are effectively down):

Cisco Identity Services Engine Administrator Guide, Release 2.3 - Set Up Cisco ISE in a Distributed Environment [Cisco …

[felipesanchezº]

Hi,

What happens when both nodes still down. How can I recover the admin services in the deployment?

[Greg Gibbs]

If both the Primary and Secondary PAN fail and are un-recoverable, you would need to rebuild them (if hardware failures, it would require opening a TAC case for an RMA) and restore from the most recent Configuration Backup.