ISE Primary/Secondary max latency

Question

Hi There,
My understanding is that you can run ISE with one node set as primary and zero or more nodes set as secondary, with the secondaries located closer to the end points.
1. Does this mean the local users closest to a secondary node will authenticate against it rather than hitting the primary?
2. What if the delay between primary and secondary is larger, say 700ms-1000ms. Is this going to flap and desync?
Thanks,
Brendan

Answer 1

Yes you can have Primary and secondary ISE in your Distributed env.
A  Cisco ISE node can provide various services based on the persona that it  assumes. Each node in a deployment, with the exception of the Inline  Posture node, can assume the Administration, Policy Service, and  Monitoring personas. In a distributed deployment, you can have the  following combination of nodes on your network:
•Primary and secondary Administration nodes for high availability
•A pair of Monitoring nodes for automatic failover
•One or more Policy Service nodes for session failover
•A pair of Inline Posture nodes for high availability
1. No, As per my understanding All your clients authenticate with primary ISE.
2. When Primary ISE is down then:
When the primary Administration ISE node becomes unavailable, we must log into the secondary Administration ISE node and promote it to become the primary Administration ISE node. There is no automatic failover for the AdministrationISE node.- Means High Avilability )
In case the primary Monitoring ISE node goes down, the secondary Monitoring ISE node automatically
becomes the primary Monitoring ISE node.
Regards