300-715 · Question #250
An engineer wants to learn more about Cisco ISE and deployed a new lab with two nodes. Which two persona configurations allow the engineer to successfully test redundancy of a failed node? (Choose…
The correct answer is C. Configure one of the Cisco ISE nodes as the primary PAN and MnT personas and the other as E. Configure one of the Cisco ISE nodes as the primary PAN and PSN personas and the other as. To test redundancy with two Cisco ISE nodes, both the Policy Administration Node (PAN) and Policy Service Node (PSN) personas need to be deployed in a redundant pair. This requires one node to act as primary for PAN/MnT, and the other as secondary for PAN/MnT, alongside…
Question
An engineer wants to learn more about Cisco ISE and deployed a new lab with two nodes. Which two persona configurations allow the engineer to successfully test redundancy of a failed node? (Choose two.)
Options
- AConfigure one of the Cisco ISE nodes as the Health Check node.
- BConfigure both nodes with the PAN and MnT personas only.
- CConfigure one of the Cisco ISE nodes as the primary PAN and MnT personas and the other as
- DConfigure both nodes with the PAN, MnT, and PSN personas.
- EConfigure one of the Cisco ISE nodes as the primary PAN and PSN personas and the other as
How the community answered
(33 responses)- A9% (3)
- B12% (4)
- C76% (25)
- D3% (1)
Why each option
To test redundancy with two Cisco ISE nodes, both the Policy Administration Node (PAN) and Policy Service Node (PSN) personas need to be deployed in a redundant pair. This requires one node to act as primary for PAN/MnT, and the other as secondary for PAN/MnT, alongside redundant PSN functionality.
"Health Check node" is not a standard Cisco ISE persona or configuration for redundancy.
Configuring both nodes with only PAN and MnT personas would provide redundancy for administration and monitoring but would lack any PSN functionality to handle actual authentication requests.
Configuring one node as primary PAN and MnT and the other as secondary PAN and MnT creates redundancy for administrative and monitoring services. This ensures that if the primary node fails, the secondary can take over administrative functions and session logging.
Configuring both nodes with PAN, MnT, and PSN personas simultaneously (all three on both) does not explicitly define the primary/secondary roles necessary for testing specific redundancy scenarios like failover, especially for PAN, and is not an optimal small deployment configuration.
Configuring one node as primary PSN and the other as secondary PSN provides redundancy for the authentication, authorization, and accounting services. This is crucial for maintaining network access services if one PSN node becomes unavailable, distributing the load and ensuring high availability for authentication requests.
Concept tested: Cisco ISE Distributed Deployment - High Availability and Redundancy
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_3_0_chapter_010.html#concept_E2FE9C6F69D843FE95D2BB7FC058C360
Topics
Community Discussion
No community discussion yet for this question.