Cisco Ise 13 User Guide

Table 3: Cisco ISE Nodes and Available Menu Options
Available Menu OptionsCisco ISE Node
•ViewandconfiguresystemtimeandNTPserver
settings.
•Installservercertificate,managecertificate
signingrequest.
Theservercertificateoperationsmust
beperformeddirectlyoneach
individualnode.Theprivatekeysare
notstoredinthelocaldatabaseandare
notcopiedfromtherelevantnode;the
privatekeysarestoredinthelocalfile
system.
Note
AllNodes
Allmenusandsub-menus.PrimaryPAN
•Homeandoperationsmenus....

ISEnode.Youcan,however,editthepersonasandservicesoftheprimaryandsecondaryCiscoISEnodes.
YoumustfirstconfigureaprimaryISEnodeandthenregistersecondaryISEnodestotheprimaryISEnode.
Ifyouareloggingintothenodeforthefirsttime,youmustchangethedefaultadministratorpasswordand
installavalidlicense.
ItisrecommendednottochangethehostnameandthedomainnameonCiscoISEthathavebeenconfigured
orinproduction.Ifitisrequired,thenreimagetheappliance,makechanges,andconfigurethedetailsduring
theinitialdeployment.
Before You Begin...

configurationchangesthatyoumakefromtheDeploymentpageofthePrimaryPAN.However,expecta
delayof5minutesforyourchangestotakeeffectandappearontheDeploymentpage.
Before You Begin
Ensurethattheprimarynode’strustedcertificatestorehastheappropriatecertificateauthority(CA)certificates
tovalidatetheHTTPScertificateofthesecondarynodethatyouaregoingtoregister.Whenyouimportthe
secondarynode'scertificateintothetrustedcertificatestore,checktheTrustforauthenticationwithinISE...

registrationanddatabasesynchronization,enterthecredentialsofthePrimaryPANtologintotheuser
interfaceofthesecondarynode.
InadditiontotheexistingPrimarynodeinthedeployment,whenyousuccessfullyregisteranewnode,
noalarmcorrespondingtothenewlyregisterednodeisdisplayed.TheConfigurationChangedalarms
reflectinformationcorrespondingtothenewlyregisterednodes.Youcanusethisinformationtoascertain
thesuccessfulregistrationofthenewnode.
Note
What to Do Next...

Available When the Primary PAN Goes Down
(Yes/No)
Feature
YesExistingendpointwithnoprofilechange
YesExistingendpointwithprofilechange
YesNewendpointlearnedthroughprofiling
YesExistingguest–LWA
YesExistingguest–CWA
No(Guestmustloginwitholdpassword)Guestchangepassword
YesGuest–AUP
NoGuest–MaxFailedLoginEnforcement
NoNewGuest(SponsoredorSelf-registered)
YesPosture
NoNewDeviceRegistration
YesExistingRegisteredDevices
NopxGrid
Manually Promote Secondary PAN To Primary...

Step 4ClickSave.
What to Do Next
IfthenodethatwasoriginallythePrimaryPANcomesbackup,itwillbedemotedautomaticallyandbecome
theSecondaryPAN.Youmustperformamanualsynchronizationonthisnode(thatwasoriginallythePrimary
PAN)tobringitbackintothedeployment.
IntheEditNodepageofasecondarynode,youcannotmodifythepersonasorservicesbecausetheoptions
aredisabled.YouhavetologintotheAdminportaltomakechanges.
Policy Service Node
ACiscoISEnodewiththePolicyServicepersonaprovidesnetworkaccess,posture,guestaccess,client...

Session Failover in Policy Service Nodes
WhenaPolicyServicenodethathasactiveURL-redirectedsessionsfails,theendpointsarestuckinan
intermediatestate.EveniftheredirectendpointdetectsthatthePolicyServicenodethatithasbeen
communicatingwithhasfailed,itcannotre-initiateauthorization.
IfthePolicyServicenodesarepartofanodegroup,thenodeswithinanodegroupexchangeheartbeat
messagestodetectnodefailures.Ifanodefails,oneofitspeersfromthenodegrouplearnsabouttheactive...

Automatic Failover in Monitoring Nodes
ThetermautomaticfailoverisusedbecausehighavailabilityisnotsupportedonMonitoringnodesinthetrue
sense.ForMonitoringnodes,operationauditdataisduplicatedbythePolicyServicenode(s),whichthen
sendscopiestoboththeprimaryandsecondaryMonitoringnodes.
Monitoringisservedfromtheprimary(active)Monitoringnode.Monitoringdataisonlyservedfromthe
secondary(standby)Monitoringnodewhentheactivenodeisdown.Thesecondarymonitoringnodeis
read-only.
Note
Automatic Failover Process...

•Inanactive-standbyconfigurationofthemonitoringnodes,thePrimaryAdministrationNode(PAN)
alwayspointstotheactivemonitoringnodetocollectthemonitoringdata.Aftertheactivemonitoring
nodefails,thePANpointstothestandbymonitoringnode.Thefailoverfromtheactivemonitoringnode
tothestandbymonitoringnodehappensafteritisdownformorethan5minutes.
However,aftertheactivenodefails,thestandbynodedoesnotbecometheactivenode.Incasethe
activenodecomesup,theAdministrationnodestartscollectingthemonitoringdataagainfromthe...

ThefollowinglogsareavailableforpxGridnode:
•pxgrid.log—Statechangenotifications.
•pxgrid-cm.log—Updatesonpublisher/subscriberanddataexchangeactivitybetweenclientandserver.
•pxgrid-controller.log—Displaysthedetailsofclientcapabilities,groups,andclientauthorization.
•pxgrid-jabberd.log—Alllogsrelatedtosystemstateandauthentication.
•pxgrid-pubsub.log—Informationrelatedtopublisherandsubscriberevents.
pxGrid Client and Capability Management...