C9800 WLC HA SSO and ISE configuration

[FilipX]

I have two C9800-L-F controllers working in standalone configuration. They are both connected to ISE with their WMI addresses, 192.168.168.40 for the first and 192.168.168.43 for the second.
I intend to implement HA SSO (RMI + RP) for these devices, and I am following this guide:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/220277-configure-high-availability-sso-on-catal.html
My plan is to use 192.168.168.41 and 192.168.168.42 as RMI addresses for both devices, respectively.

There is one thing in the procedure that is not explained very well, considering the AAA authentication. This note is from the guide: "Note: If you are using a AAA server, you need to add both the WMI IP address as well as the RMI IP address as AAA clients on your AAA server. The standby WLC always uses its RMI IP to authenticate SSH sessions. The active WLC uses both RMI and WMI to reach out to the AAA server."

As I understand it, I should add the new (RMI) addresses to ISE configuration for the controllers. But if I try to do so, I get an error on ISE: "Failed to create network device - trustSec.sgaCoaSupportType : CoA cannot be enabled for more than one device."
This means that I can't add a secondary IP for the controller in ISE.

My question is this: which IP should be configured in ISE for each device in the HA pair, the RMI (different IPs for each unit) or WMI, which is a single IP for a HA pair? How can I specify the same WMI for both devices, when ISE does not allow more than one device with the same address?

Thanks,
Filip

[marce1000]

  - Simple use the WMI IP only ,as far as the RMI is concerned you could create another NAD in ISE with that address.
    For the controller ; always checkout the intended configuration with the CLI command show tech wireless and feed
    the output from that into Wireless Config Analyzer
                                Consider the use of the above procedure mandatory !

  M.

[FilipX]

Thank you for the prompt answer.
Just to be clear, should I have only one NAD in ISE with the WMI address which will serve both controllers?
Are the other two NADs with RMI addresses mandatory or optional?
Is it possible to have two objects (NADs) with two different IPs for the same device in ISE?

Thanks,
Filip

[marce1000 · Accepted solution]

  - Use one NAD  with the WMI address only (HA-standby controller is always inactive)
     I would simply create the other 2 NADs anyway and check if they are used or not afterwards in the ISE logs.

     >....Is it possible to have two objects (NADs) with two different IPs for the same device in ISE?
     Yes , for ISE they are simply two different devices

 M.

[Scott Fella]

In ISE, you can define one NAD for each device and within that configuration, you can specify more than one ip address.  No matter what, you should look at the radius live logs or your tacacs live logs and make sure you see what NAD ip is sending the info.  You should also take time to do a failover to make sure your radius/tacacs is still working.

[FilipX]

I get an error when I try to add a secondary IP address for a device in ISE. ("Failed to create network device - trustSec.sgaCoaSupportType : CoA cannot be enabled for more than one device.")
So I created one NAD with the WMI address and two more with RMI addresses. As I can see from the live logs, all authentications are using the first NAD. RMI NADs are not used.

Thank you for your help,
Filip