1. I want to deploy two ISE nodes in different DC for redundancy, but i don't know which TCP/IP ports two ones use to communicate with each other for registration and replication data. I need those ports for open firewall rule.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_0110.html
2. What's extract data replicated between two nodes? Database/configuration/...? How frequency it is synchronized between them?
There is a significant number of different data streams that will pass between these two nodes. I would look at the link above for ports and communication between node roles. Your configuration replication between the two nodes is essentially real time as will authentication logs.
3. How can i monitor heath of those nodes? (my company only purchase two VMs license so we can not deploy automatic heath check nodes). Can i monitor those node by network monitor tool using SNMP?
There are a number of SNMP polls supported, you can also enable smtp email alerts for a long list of issues. Look at my previous post here for more info on SNMP monitoring. https://community.cisco.com/t5/identity-services-engine-ise/monitor-ise-process-through-snmp/m-p/3718768/highlight/true#M18685
4. My company want to migrate from ACS 4.2 to ISE 2.4 for device administrator. Can i export username/password/network device group/policy from ACS to ISE?
You will not be able to migrate ACS 4.2 to 2.4 via the migration tool Cisco has built. This would be possible if you were running ACS 5.5 or newer.
You will not be able to migrate user accounts from ACS to ISE
You can import ACS NADs to ISE via a CSV file. You will have to manipulate the data.
You will have to build your ACS policies manually in ISE
5. Which data can i backup from ISE for restoring in the future? Configuration/database/...?
You can backup the ISE configuration (all GUI and ADE-OS config) based on the backup/restore page. You will create a schedule, and ISE will backup itself and export to a repository of your choosing. This can be restored to a new standalone ISE node if you deployment was to fail.
You can also backup your radius/tacacs logs via the same backup restore portal, this is called the operation data.
If you build your ISE deployment in the lab, you can backup the config, restore it on a new node in production, then join the second production node to the deployment.
As an additional note, you need to make sure you stay under 300ms round trip time latency between your two ISE nodes.
... View more
