Due to a recent network incident, all access to network devices must be centrally logged and tracked in Cisco ISE. On which nodes must the Device Admin service be enabled?

The PAN (Primary Administration Node) handles administration and database services, but not the runtime TACACS+ services for device administration.

The Device Admin service, also known as TACACS+ service, runs on Policy Service Nodes (PSNs). When network devices (like switches, routers, firewalls) authenticate and authorize administrators via TACACS+, they communicate with the PSNs. Therefore, to ensure redundancy and distribute the load for all access to network devices, the Device Admin service should be enabled on each PSN that will handle these requests.

PANs do not host the Device Admin (TACACS+) runtime service.

While a PSN can host the Device Admin service, enabling it on only one PSN would create a single point of failure and limit scalability for handling all network device access requests across the network.