ISE redundancy/failover over distributed environment at different geographically locations.

[prado1985]

Hi,

I have a use case where i need to configure ISE at two different geographical locations:  HO (India) and BO (USA).

Requirement is, if the ISE server fails at US Branch, all the endpoints must automatically fail-over to HO (India) and the endpoints in US must be 802.1x authenticated and the authorization policy to be given by HO ISE server. However, to achieve this i don't see secondary ISE point configuration is Switch.

ISE configuration(Standalone deployment), Integration with NAD and AD, dot1x etc, is much familiar to me. But, internet documents are not helping much in this requirement.

Can someone give much clarity to achieve the fail-over part for this use case pls?

Thanks,

Sagar

[Rahul Govindan]

If both nodes are acting as Policy Nodes (PSN), you can have both as Radius servers in a aaa server group. The second radius server in the group acts as backup in case first one is not reachable. Example to configure that on a switch is here:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_rad/configuration/xe-3se/5700/sec-usr-rad-xe-3se-5700-book/sec-rad-aaa-server-groups.html#GUID-5B656046-CF52-4B95-8292-71EC081FD041

As seen in the example above, you would then call your AAA group in the "aaa authentication" and "aaa authorization" commands.

[prado1985]

Hi Rahul,

Thank you for your valuable response. I'll implement as per the reference example and revert with the result.

Thanks again,

Pradeep

[nspasov]

One thing to keep in mind here is that the maximum round trip delay between the nodes has to be < 300 ms. Anything over that will not be supported by Cisco TAC and you might encounter database replication issues. If the delay is > 300 ms then you will need to deploy two separate instances of ISE that are not replicating to each other. 

I hope this helps!

Thank you for rating helpful posts!