Personas and Node Roles

What it is

A persona is a role that an Identity Services Engine node plays in a deployment.

Cisco ISE splits its work into four personas. A node can run one persona or several at once. Which personas run on which node is a design choice you make in the admin portal.

How it works

You assign personas on each node, and the primary administration node pushes configuration to the rest.

Administration persona

The Policy Administration Node is the single place where you change configuration. Changes are written to the primary PAN and then replicated to every other node.

A deployment has one primary PAN. You can add one secondary PAN that takes over if the primary fails. Promotion of the secondary is manual unless you set up automatic failover.

Policy Service persona

The Policy Service Node does the real work. It receives authentication requests, evaluates the policy sets and returns the authorization result.

Several services are switched on under the PSN persona:

• Session services handle network access authentication and authorization.
• Profiling service runs the probes that classify endpoints.
• Device Admin service answers TACACS+ requests.
• Passive identity service learns users from sources such as Active Directory login events.

If you do not enable these services, the node does not take part in that function. A PSN without session services will not answer RADIUS requests for network access.

Monitoring persona

The Monitoring node stores the logs that PSNs send. It feeds Operations, including the RADIUS and TACACS live logs and the reports.

You can have a primary and a secondary MnT. PSNs send their logs to both, so the secondary holds a copy.

pxGrid persona

pxGrid lets ISE publish session and endpoint context to other platforms. It lets subscribers act on that context, for example to quarantine an endpoint.

Standalone and distributed nodes

A freshly installed node is a standalone node. It runs the Administration, Policy Service and Monitoring personas together.

When you register a second node to it, the first node becomes the primary PAN and the deployment becomes distributed. The path in the admin portal is Administration, System, Deployment.

Registering a node

Registration is done from the primary node, not from the node you are adding.

1. Install the new node and finish its setup, so it has a fully qualified domain name and an IP address.
2. Make sure both nodes resolve each other by name in DNS and that their clocks agree through NTP.
3. On the primary, open the deployment page and choose Register.
4. Enter the FQDN of the new node and the admin credentials, then select its personas.
5. Wait for the sync. The new node restarts its services and joins.

The primary has to trust the certificate that the new node presents. If it does not, import the new node's certificate into the trusted certificates of the primary first.

ise-pan/admin# show application status ise
ise-pan/admin# show version

The show application status ise command lists the running ISE processes on a node. It is the quick check that the application is up after a registration or restart.

Node groups

A node group is a set of PSNs that keep in contact with each other. If one PSN in the group fails, another member can take over a pending CoA for its sessions. Put PSNs that sit in the same site and share a fast network in one group.