Cisco ISE 1.4 HA Setup

aslam.bajwa · ‎06-27-2015

Hi All ,

i have Cisco ISE 1.4 Appliances , i facing Error while configuring Failover . i have attached the Error Sreenshot.

Please Advise .

nspasov · ‎06-27-2015

This error indicates that the servers do not trust the Certificate Authority that issued the ISE server certificates. If you are using certificates that were issued by a public CA (GoDaddy, VeriSign, etc) then you will need to import the root CA certificate in the trusted certificate stores in ISE.

If you are using self-signed certificates then you will need to:

1. Export the certificate from the secondary node (that you are trying to join)

2. Import it in the "Trusted Certificates" store in your primary node

3. Check the box that says "Trust for authentication within ISE"

4. Try to join the secondary node again.

Thank you for rating helpful posts!

aslam.bajwa · ‎06-27-2015

Thanks Neno ,

i will apply the workaround you have mentioned and will be able to update you after 2 days .

many thanks

nspasov · ‎06-27-2015

No problem. Let us know how it goes. Here are a couple of links from Cisco with the exact information needed:

Certificate Export/Import Process for HA:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide_14_chapter_01000.html#task_9224A3D0555C42E3A5C7FFE6D3D2D174

Setting up Distributed Deployment:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide_14_chapter_011.html

Thank you for rating helpful posts!