07-17-2018 12:20 PM - edited 02-21-2020 11:01 AM
Hi all,
I have received a distributed environment for Cisco ISE from a client where they have configured an ISE node in one location as Primary in Admin, Sec in Monitoring and another ISE in another location as Secondary in Admin, Primary in Monitoring. So I just wanted to know how different is this scenario if failover was enabled between them.
Regards,
Abhijit
07-17-2018 01:56 PM
I suggest to have a look at one of the cisco Live presentation, and you have more clarity about the setup.
It all depends on how you choose and deploy.
http://d2zmdbbm9feqrf.cloudfront.net/2015/eur/pdf/BRKSEC-3699.pdf
BB
07-17-2018 05:06 PM
I had the same question once because I read about that exact scenario in an ISE book called "
The author talks about this and it appears to make sense for hardware ISE nodes where you want to spread the work load between Active PAN and Active MnT. Why make one node Active PAN and Active MnT, while the other node just sits around in Secondary mode?
But when I asked this question to the Cisco TME's on the ISE Community Forum, they told me not to do what you're describing. In other words, keep both the PAN and MnT personas Active on one node, and Standby on the other node.
07-17-2018 06:27 PM
Thanks everyone for your suggestions but I think I have not made myself clear; so i will rephrase. My question was: Whats the difference between enabling failover between 2 devices/personas and configuring primary/secondary between 2 devices/personas. Which method is better?
07-17-2018 06:29 PM
Thanks everyone for your suggestions but I think I have not made myself clear; so i will rephrase. My question was: Whats the difference between enabling failover between 2 devices/personas and configuring primary/secondary between 2 devices/personas. Which method is better?
07-17-2018 06:57 PM
Just to be clear, I understand you have two nodes that have the Admin and Monitoring personas enabled.
In that case there are two possible combinations
Combo 1:
Node 1: Primary Admin, Primary MnT
Node 2: Secondary Admin, Secondary MnT
Combo 2
Node 1: Primary Admin, Secondary MnT
Node 2: Secondary Admin, Primary MnT
Now your question is about failover?
There is no MnT failover as such, but as you probably know, you can promote the Secondary MnT to Primary and this will not cause any disturbance or changes to the PAN persona.
The PAN is a bit different. If you promote the Secondary PAN to Primary, then the application services will restart on both nodes.
After a PAN promotion the result will be as follows:
Combo 1: (no change to MnT)
Node 1: Secondary Admin, Primary MnT
Node 2: Primary Admin, Secondary MnT
Combo 2: (no change to MnT)
Node 1: Secondary Admin, Secondary MnT
Node 2: Primary Admin, Primary MnT
I don't understand what the question is - there is no design choice (or considerations) as far as I can see. Unless I still haven't understood the question.
By the way, what do you mean by "enable failover"? Are you talking about Automatic PAN Failover? As far as I know, it's just the automated way of doing the same thing as I described above. You need an outside PSN (in your case) to be the monitors who decide when to trigger the promotion. Is that what you're trying to achieve? In that case the design question is, WHICH PSN do I designate to monitor which PAN node.
I would argue that the PSN closest to the PAN (i.e. in same data centre) is the one to use because it would allow the PAN to be monitored in the event of an inter-data centre WAN failure. If WAN link fails then there will be no PAN promotion since each PSN believes their PAN is alive. If you chose the alternative, using cross-DC PSN monitors, then a WAN failure would cause the Standby PAN to be promoted, and you'll have two active PAN nodes with a split brain network. This is to my knowledge how it would work - but I stand to be corrected.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: