Hello Sachin-
Couple of questions:
1. Is there a firewall between the two nodes that you are trying to cluster? If yes, then have you confirmed that all of the necessary ports and protocols are opened between them?
2. What version of ISE are you using
3. Can you confirm that both devices are added in DNS and that both devices can ping each other via their FQDNs
On a side note here are the prerequisites for clustering nodes:
• The fully qualified domain name (FQDN) of the standalone node that you are going to register, for
example, ise1.cisco.com must be DNS-resolvable from the primary Administration ISE node.
Otherwise, node registration will fail. You must enter the IP addresses and FQDNs of the ISE nodes
that are part of your distributed deployment in the DNS server.
• The primary Administration ISE node and the standalone node that you are about to register as a
secondary node should be running the same version of Cisco ISE.
• You must configure the Cisco ISE Admin password at the time you install the Cisco ISE. The
previous Cisco ISE Admin default login credentials (admin/cisco) are no longer valid.
• Use the username/password that was created during the initial Setup or the current password, if it
was changed later.
• The DB passwords of the primary and secondary nodes should be the same. If these passwords are
set to be different during node installation, you can modify them using the following commands:
– application reset-passwd ise internal-database-admin
– application reset-passwd ise internal-database-user
• You can alternatively create an administrator account on the node that is to be registered and use
those credentials for registering that node. Every ISE administrator account is assigned one or more
administrative roles. To register and configure a secondary node, you must have either the Super
Admin or System Admin role assigned. See Cisco ISE Admin Group Roles and Responsibilities for
more information on the various administrative roles and the privileges associated with each of
them.
• If you plan to register a secondary Administration ISE node for high availability, we recommend
that you register the secondary Administration ISE node with the primary first before you register
other Cisco ISE nodes. If Cisco ISE nodes are registered in this sequence, you do not have to restart
the secondary ISE nodes after you promote the secondary Administration ISE node as your primary.
• If you plan to register multiple Policy Service ISE nodes running Session services and you require
mutual failover among those nodes, you must place the Policy Service ISE nodes in a node group.
You must create the node group first before you register the nodes because you must select the node
group to be used on the registration page.
“Creating, Editing, and Deleting Node Groups”
section on page 9-21 for more information.
• Ensure that the Certificate Trust List (CTL) of the primary node is populated with the appropriate
Certificate Authority (CA) certificates that can be used to validate the HTTPS certificate of the
standalone node (that you are going to register as the secondary node).
Thank you for rating!
