ISE redundant NICs

Hello All,
does somebody know or point me how to configure redundant NICs on ISE Appliance SNS-3495-K9?
There can be only configured rudundant mode for CIMC, but not for the rest. I want to use Etherchannel or Bonding active-standby, to have the appliance connected to switches for more redundancy.
I haven't found anything like this in documentation and I cannot believe, that Cisco will not support this feature on theri appliances.
Thanks!
Karel

Hello,
the only document I found regarding the NIC redundancy is as follows:-
Step During boot up, press F8 when prompted to open the BIOS CIMC Configuration Utility. The following screen appears.
Step Set the NIC mode to your choice for which ports to use to access the CIMC for server management (see Figure 1-3 on page 1-3 for identification of the ports):
–Dedicated—The 1-Gb Ethernet management port is used to access the CIMC. You must select NIC redundancy None and select IP settings.
–Shared LOM (default)—The two 1-Gb Ethernet ports are used to access the CIMC. This is the factory default setting, along with Active-active NIC redundancy and DHCP enabled.
–Cisco Card—The ports on an installed Cisco UCS P81E VIC are used to access the CIMC. You must select a NIC redundancy and IP setting.
Note The Cisco Card NIC mode is currently supported only with a Cisco UCS P81E VIC (N2XX-ACPCI01) that is installed in PCIe slot 1. Refer to the following section in the Cisco UCS C220 Server Installation and Service Guide: Special Considerations for Cisco UCS Virtual Interface Cards.
Step Use this utility to change the NIC redundancy to your preference. This server has three possible NIC redundancy settings:
–None—The Ethernet ports operate independently and do not fail over if there is a problem.
–Active-standby—If an active Ethernet port fails, traffic fails over to a standby port.
–Active-active—All Ethernet ports are utilized simultaneously.
For furhter details please folloe the link below:-
http://www.cisco.com/en/US/docs/security/ise/1.1.1/release_notes/ise111_rn.html

Similar Messages

Support Redundant NIC cards in a HP server

Hi
I would like to connect a HP server with two NIC cards (for redundancy) to two CISCO 2970 switches.
From the HP site they configured Channel Bonding
[root@sm36s_donald root]# ifconfig -a
bond0 Link encap:Ethernet HWaddr 00:14:38:EE:6C:6F
inet addr:172.23.160.36 Bcast:172.23.160.63 Mask:255.255.255.192
UP BROADCAST RUNNING MASTER MULTICAST MTU:1500 Metric:1
RX packets:563837 errors:0 dropped:0 overruns:0 frame:0
TX packets:110645 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:49833329 (47.5 Mb) TX bytes:17943723 (17.1 Mb)
eth0 Link encap:Ethernet HWaddr 00:14:38:EE:6C:6F
inet addr:172.23.160.36 Bcast:172.23.160.63 Mask:255.255.255.192
UP BROADCAST RUNNING SLAVE MULTICAST MTU:1500 Metric:1
RX packets:563837 errors:0 dropped:0 overruns:0 frame:0
TX packets:110645 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:49833329 (47.5 Mb) TX bytes:17943723 (17.1 Mb)
Interrupt:25
eth1 Link encap:Ethernet HWaddr 00:14:38:EE:6C:6F
inet addr:172.23.160.36 Bcast:172.23.160.63 Mask:255.255.255.192
UP BROADCAST SLAVE MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:26
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8239071 errors:0 dropped:0 overruns:0 frame:0
TX packets:8239071 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:670754425 (639.6 Mb) TX bytes:670754425 (639.6 Mb)
What I have to configure from the Cisco switches site in order to avoid ARP problems?
Thank you for your support
Stelios

Stelios,
We have had issues when trying to load balance between the NICs. when in active/active, the virtual MAC reflects in both the connected switch ports, and the packets tend to loop between the ports. There will be a lot of Spanning Tree TCNs generated, which can shoot up the CPU. We had a 4507R with SUP IV, which got loaded to 70% when doing load balancing. when we made it active/standby on the NIC, the CPU came down to 1 %...
so just be careful on this. best way of doing it is active/standby
hope this helps.. all the best.. rate replies if found useful..
Raj

Redundant NIC in MCS-7825-H1 Server

Guys,
Do you now the procedure how to run the on-board dual NIC and worked as an active and standby in MCS-7825-H1 server from HP.
Do I need a third party software? Do I need to do any configuration in the switches or ONLY in the server?
Please be advised.

hi,
normaly the ntwork teaming driver will be in:
C:\utils\dualnic
have a look at this:
http://www.cisco.com/en/US/products/hw/voiceapp/ps378/prod_installation_guide09186a008015a131.html
http://www.cisco.com/en/US/products/hw/voiceapp/ps378/prod_installation_guide09186a0080203ebc.html
http://www.cisco.com/en/US/products/hw/voiceapp/ps378/prod_installation_guide09186a00806a476f.html
regards
mehmet

NICs for Private Interconnect redundancy

DB/Grid version : 11.2.0.2
Platform : AIX 6.1
We are going to install a 2-node RAC on AIX (that thing which is almost good as Solaris )
Our primary private interconnect is
### Primary Private Interconnect
169.21.204.1      scnuprd186-privt1.mvtrs.net scnuprd186-privt1
169.21.204.4      scnuprd187-privt1.mvtrs.net scnuprd187-privt1For Cluster inteconnect's redundancy , Unix team has attached an extra NIC for each node with an extra Gigabit-ethernet switch for these NICs.
###Redundant Private Interconnect attached to the server
169.21.204.2      scnuprd186-privt2.mvtrs.net scnuprd186-privt2 # Node1's newly attached redundant NIC
169.21.204.5      scnuprd187-privt2.mvtrs.net scnuprd187-privt2 # Node2's newly attached redundant NICExample borrowed from citizen2's post
Apparently I have 2 ways to implement cluster inteconnect's redundancy
Option1. NIC bonding at OS level
Option2. Let grid software do it
Question1. Which is better : Option 1 or 2 ?
Question2.
Regarding Option2.
From googling and OTN , i gather that , during grid installation you just provide 169.21.204.0 for cluster inteconnect and grid will identify the redundant NIC and switch. And if something goes wrong with the Primary Interconnect setup (shown above) , grid will automatically re-route interconnect traffic using the redundant NIC setup. Is this correct ?
Question 3.
My colleague tells me , for the redundant Switch (Gigabit) Unless I configure some Multicasting (AIX specific), I could get errors during installation. He doesn't clearly what it was ? Anyone faced Multicasting related issue on this ?

Hi,
My recommendation is to you use the AIX EtherChannel.
The EtherCannel of AIX is much more powerfull and stable compared with HAIP.
See how setup AIX EtherChannel on 10 Gigabit Ethernet interfaces
http://levipereira.wordpress.com/2011/01/26/setting-up-ibm-power-systems-10-gigabit-ethernet-ports-and-aix-6-1-etherchannel-for-oracle-rac-private-interconnectivity/
If you choose use HAIP I recommend you read this note, and find all notes about bugs of HAIP on AIX.
11gR2 Grid Infrastructure Redundant Interconnect and ora.cluster_interconnect.haip [ID 1210883.1]
ASM Crashes as HAIP Does not Failover When Two or More Private Network Fails [ID 1323995.1]
About Multicasting read it:
Grid Infrastructure 11.2.0.2 Installation or Upgrade may fail due to Multicasting Requirement [ID 1212703.1]
Regards,
Levi Pereira

ISE installation Suggestion required

Dear All,
This is sarveswaran and am working as a network engineer.
We have recently bought the ISE server and one 2504 WLC and two 3650 WLC.
Below are the agenda
Install the access points into the floor on the 3650 WLC and through the ISE authentication should takes place. Also we wanted to restrict the wireless access only to Domain users.
For Guest users, the authentication should takes place in the ISE. once validated, the guest will need to get the internet from 2504 WLC which we placed into the DMZ Zone. The reason why is to make sure the guest user doesnt want to enter into the network.
Whether ISE supports NIC redundancy, other than CIMC.
Expecting your feedback/suggestion and let me know if required any additional information.

Please refer
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_010011.html
and
https://supportforums.cisco.com/discussion/11863271/ise-redundant-nics

Private Interconnect redundancy

Grid Version : 11.2.0.2
OS : Solaris 10 on HP Proliant
Currently we have a 2-node RAC running with 4 live DBs.
Currently our private interconnect is
### Current Private Interconnect
169.21.204.1      scnuprd186-privt1.mvtrs.net scnuprd186-privt1
169.21.204.4      scnuprd187-privt1.mvtrs.net scnuprd187-privt1To have redundancy for private interconnect , After repeated requests, our Unix team has finally attached a redundant NIC for each node with a redundant Gigabit-ethernet switch.
So, we need to add the below NIC to the CRS. How can we do that?
###Redundant Private Interconnect (currently attached to the server, but yet to be 'included' in the cluster)
169.21.204.2      scnuprd186-privt2.mvtrs.net scnuprd186-privt2 # Node1's newly attached redundant NIC
169.21.204.5      scnuprd187-privt2.mvtrs.net scnuprd187-privt2 # Node2's newly attached redundant NIC

Citizen_2 wrote:
Grid Version : 11.2.0.2
OS : Solaris 10 on HP Proliant
Currently we have a 2-node RAC running with 4 live DBs.
Currently our private interconnect is
### Current Private Interconnect
169.21.204.1      scnuprd186-privt1.mvtrs.net scnuprd186-privt1
169.21.204.4      scnuprd187-privt1.mvtrs.net scnuprd187-privt1To have redundancy for private interconnect , After repeated requests, our Unix team has finally attached a redundant NIC for each node with a redundant Gigabit-ethernet switch.You can use IPMP (IP MultiPath) in Solaris.
First, note that these should be NON-ROUTABLE addresses configured on a PRIVATE-Dedicated Switch. It would look something like this:
169.21.204.1 scnuprd186-privt1-IPMPvip.mvtrs.net scnuprd186-privt1-IPMPvip
169.21.204.2 scnuprd186-privt1-nic1.mvtrs.net scnuprd186-privt1-nic1 eth2
169.21.204.3 scnuprd186-privt1-nic2.mvtrs.net scnuprd186-privt1-nic2 eth3
169.21.204.4 scnuprd187-privt1-IPMPvip.mvtrs.net scnuprd187-privt1-IPMPvip
169.21.204.5 scnuprd187-privt1-nic1.mvtrs.net scnuprd187-privt1-nic1 eth2
169.21.204.6 scnuprd187-privt1-nic2.mvtrs.net scnuprd187-privt1-nic2 eth3
IPMP has a "real address" for each "real" interface and the IPMPvip's will "float" between the eth2 and eth3 devices depending on which one is active. Similar to the way the host vip can "float" between nodes. It is the IPMPvip addresses that are provided to the CRS configuration.
I have used this on Sun 6900's and it worked great.
Now, it can get extremely complicated if you were to also use IPMP on the public interfaces as well. It does work, you just need to pay attention to how you configure it.
>
So, we need to add the below NIC to the CRS. How can we do that?
###Redundant Private Interconnect (currently attached to the server, but yet to be 'included' in the cluster)
169.21.204.2      scnuprd186-privt2.mvtrs.net scnuprd186-privt2 # Node1's newly attached redundant NIC
169.21.204.5      scnuprd187-privt2.mvtrs.net scnuprd187-privt2 # Node2's newly attached redundant NIC

Teamed NICs for RAC interconnect

Hi there,
We have an Oralce 10g RAC with 2 nodes. there are only one NIC for RAC interconnect in both servers.
now we want to add one redundant NIC into each server for RAC interconnect as well.
Could you please guide me some documents about this "teamed NICs for RAC interconnect "?
Your help is greatly appreciated!
Thanks,
Scott

Search around for NIC bonding. The exact process will depend on your OS.
Linux, see Metalink note 298891.1 - Configuring Linux for the Oracle 10g VIP or private interconnect using bonding driver
Regards,
Greg Rahn
http://structureddata.org

Prevent LBFO Primary/Standby fallback

Hi All,
I have a client requirement to implement network redundancy on a Windows Server 2012 R2 platform. So enter two switches, firewalls, routers etc.
As part of this I have set up an LBFO team on NIC 1 & 2.
The client has since informed me that they have (in the past) had flakey inter-site links which resulted in the NIC team flapping between the Primary and Standby NIC as the primary network interface went up and down. Consequently, one of the tests that
I need to implement and pass is that if the active primary interface fails, the standby picks up the active role until such a time as the secondary interface fails rather than swapping back to the primary interface when the connection is restored
TIA
Jason

The best way to avoid this problem with Active/Standby is to not use it. Generally Active/Active mode is better than Active/Standby.
As you've noticed, Active/Standby mode forces an additional failover event:
An active NIC goes down, so there is a failover to the standby NIC.
The previously-active NIC is restored, so there is a failover from the standby NIC back to the newly-restored NIC.
This additional failover is by design. The design of Active/Standby is to designate a standby NIC, and the team tries to keep that NIC on standby as much as possible.
Because of this additional failover, Active/Active mode actually gives you better fault-tolerance than Active/Standby. And of course, Active/Active also makes better use of your available bandwidth, since you get to use the bandwidth of the redundant
NIC when there is no fault. Finally, note that Active/Standby does not have any advantage in failover latency or "effectiveness"; the failover performed by Active/Active is just the same as that performed in Active/Standby.
Therefore, I actually reccomend that Active/Active is your configuration of first resort. Active/Active is better or equal to Active/Standby in most respects. (Exception: If you have a configuration where one NIC
really is worse than the others, e.g., it has a lower link speed, then Active/Standby may be appropriate.)

Windows 7 - TCP Parameter TcpMaxConnectRetransmissions and TcpInitialRTT

(this is a dummy post, for an issue which has been resolved under the partner area after i raised a break fix ticket with Microsoft, but not available to the wider audience)
We have a redundant NIC situation where we want the swap on failure to be fast, i.e. we want the default TcpMaxConnectRetransmissions to be 0 or 1, not 2. The resulting default no connection time is 21s
Research has shown posts like
http://go4answers.webhost4life.com/Example/window-registy-14268.aspx which implies this has been dropped in Windows 7 and you can no longer control a range of settings. Also see
http://blogs.technet.com/b/netro/archive/2010/08/30/tcp-ip-stack-hardening-in-operating-systems-starting-with-windows-vista.aspx
There is also TcpInitialRTT but neither work. However their is a KB
http://support.microsoft.com/kb/170359 which imply they should work. Someone is tell porkies ?
>> Is this true, we can't adjust the timeout for a connection in Windows 7, or is there still a backdoor to this functionality ?
Thanks

Hi,
I’m glad to hear your issue has been resolved. Hope your experience will help other community members facing similar problems.
Regards,
Leo
Huang
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Leo Huang
TechNet Community Support

ISE 1.2 - Multiple NICs/Load Balancing for DHCP Probe

Hello guys
Just prepping an ISE 1.2 patch 8 setup in our organization. I am going for the virtual appliances with multiple NICs. It will be a distributed deployment with 4 x PSNs behind a load balancer and there is no requirement for wireless or guest user at the moment. I've got 2 points I will like to get some guidance on:
Our DC has a dedicated mgmt network and I plan to IP the gig0 interface of the PANs, MNTs and PSNs from this subnet. All device admin, clustering, config replication, etc will be over this interface. However, RADIUS/probe/other user traffic to the ISE PSNs will be over the gig1 interface which will be addressed from another L3 network. Is this a supported configuration in ISE?
I intend to use the DHCP probe as part of device profiling and will ideally like to have just an additional ip helper to add to our switch SVI config. Also, it will appear that WLCs can only be configured for 2 DHCP servers for a given network so another consideration for when we bringing our WLAN in scope. We however use ACE load balancers within our DC and from what I have read, they do not support DHCP load balancing. Are there any workarounds to using the DHCP probe with multiple PSNs without having to add each node as an ip helper/DHCP server on the NADs?
Thanks in advance
Sayre

Hello Sayre-
For Question #1:
Management is restricted to GigabitEthernet 0 and that cannot be changed so you should be good there
You can configure Radius and Profiling to be enabled on other interfaces
Even though you are not using guest services yet, you can dedicate an interface just for that. As a result, you can separate guest traffic completely from your production network
Take a look at this link for more info:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/installation_guide/ise_ig/ise_app_c-ports.html
For Question #2
If you are using a Cisco WLC and running code 7.4 and newer you don't need to mess with the IP helper configurations.
The controller can be configured to act as a collector for client profiling and interact with the DHCP thread along with the RADIUS accounting task that is running on the controller. The controller receives a copy of the DHCP request packet sent from the DHCP thread and parses the DHCP packet for two options:
–Option 12—HostName of the client
–Option 60—The Vendor Class Identifier
After this information is gathered from the DHCP_REQUEST packet, a message is formed by the controller with these option fields and is sent to the RADIUS accounting thread, which is in turn transmitted to the ISE in the form of an interim accounting message.
Both DHCP and HTTP profiling settings are located under the "Advanced" configuration tab in the WLC
On the other hand, you can also use Anycast for profiling. You can check out some of Cisco Live's sessions for more info on that. Here is one that is from a couple of years (There are more recent ones that are available as well):
http://www.alcatron.net/Cisco%20Live%202013%20Melbourne/Cisco%20Live%20Content/Security/BRKSEC-3040%20%20Advanced%20ISE%20and%20Secure%20Access%20Deployment.pdf
I hope this helps!
Thank you for rating helpful posts!

ISE 1.2 SNS-3415 NIC Bonding / Teaming

Hello,
I have installed the SNS-3415 with ISE 1.2 and i'm trying to setup redundnacy (Team) nic modes for the authentication requests and not for management purpose.
The tests showed that when the one interface was unpluged everything was lost and nobody from our internal users was able to authenticated by the ISE node.
In contrast when i was unpluged the " second interface " (probably the inactive ) nothing was happened which shows that is a useless interface
My purpose is to connect it to my twins core switches and have a full high availability deployment.
- I have search enough on the WEB but i didn't found any clear and precisely document of saying how this could be achieved.
http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-4/installation/guide/csacs_book/csacs_hw_ins_ucs.html#wp1185589
Themis

ISE 1.2 does not support NIC teaming. Especially on appliances. There is a workaround for VM using the ESXi host to team the NICs so that it is transparent to the VM.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

[ISE + CWA] Redundant Guestportal

Hello Community,
I try to configure a redundant guest access with 2 ISE und 2 guests anchors. ISE Management and the sponsor portal are connected to eth0 (gig0) with hostname ise1.mydomain.com (ise2.mydomain.com for 2nd ISE). Eth0 is reachable from company network. The web authentication, where guests must enter their login credentials, is only reachable via eth1 (gig1) with hostname ise1-pub.mydomain.com (ise2-pub.mydomain.com for 2nd ISE).
The main problem is, that ISE always redirects to ise1.mydomain.com, which is on eth0 and therefore not reachable for wireless guests. I can configure a static hostname for redirection (which is cluster wide), but then I have no redundancy (there is no balancer reachable). So ISE must chose the correct hostname for the redirection URL depending on the ISE who authenticates the guest.
I tried to define an alias for both ISE on CLI:
ip host 10.1.1.1 ise1-pub ise1-pub.mydomain.com on primary ISE and
ip host 10.1.1.2 ise2-pub ise2-pub.mydomain.com on secondary ISE
and deleted the static ip/host entry in my authorization profile. But ISE always redirects to ise1.mydomain.com (or ise2.mydomain.com). My understanding was, that if I configure an alias, ISE will redirect to the alias IP.
Any hints?
ISE is version 1.2.1 Patch 4
Guest Anchors are 5760 with 3.6.1

Instead of having just one authz rule for the cwa redirect as normal, you can create one for each of the servers (still configured on the primary of course).
What you do is create one rule where your authz profile has the static host redirect set to ise1-pub.mydomain.com and the condition : server : ise1
Then create a copy of that rule, where you redirect to ise2-pub.mydoamin.com, and use the condition server : ise2
This will redirect to different names, depending on which of the ise servers the radius request was received by.
I attached a screenshot of the rules.

ISE CWA redirect redundancy

Hi
If in a CWA authorization profile the IP address option is used for the redirection, how will this impact on redundancy ? For instance in my implementation with 2 ISE appliances, on the Primary Admin Node the CWA profile is configured with an IP address of x.x.x.110 which is the address of the Primary ISE appliance. When the primary appliance fails how will the secondary appliance handle the above cause the x.x.x.110 ip address will then be unavailable and the new ip should be x.x.x.109....?

If you check that box and set an IP address manually then all CWA requests will go to that IP/Host Name. If you want to have redundancy then you should leave that box unchecked. Doing that will allow ISE to use the FQDN of the Radius server that is currently serving that SSID.
I hope this helps!
Thank you for rating helpful posts!

Guest web redirect with redundant ISE

Dears,
I have redundant ISE configured (primary and secondary) and integrated cisco WLC 5508.
I already configured SSID for Guest Web authentication.
With primary ISE the redirect link is working fine but when I power off the primary ISE the redirect link stop working even if I changed the Role of the secondary to primary.
Please I need your support,
Regards,

Thank you for your reply,
- Yes on the same nodegroup.
- Yes resolved correctly in the DNS.
- I will recheck it but I already create an ACL for redirect.
- Yes the both ISE defined on the Radius Auth. on the WLC.
Now I will check the ACL and back to you.
Regards,

Redundancy with dual nic servers

Hi I have 2 11500's configured with box-to-box redundancy. I have a number of app servers each with dual nic's (which are Teamed) and which are connected directly to the CSS's. Nic 1 in each goes to the master CSS1 and is therefore live. Nic2 goes to standby CSS2.The CSS's are connected two 4500 switches to the public.I am monitoring the links to the 4500's,if i switch off the master CCS1,we fail over and the servers all connect via nic2 to the new master CCS2. But when the link to the 4500 from the CSS1 Master goes down the CSS'S failover but the nic2's do not connect to the CCS2 because Nic 1 in each server has not failed ie they still see CSS1 as up. Is there a workaround to this problem ?
Thanks
J

I know of no way to link CSS interfaces so that if the uplink goes down, the the other ports are shutdown. There may be another way to configure the adapter teaming or failover on the server side. I know some OS's send out test frames from one adapter to the other to verify network integrity.
What I'd recommend is that you setup a VLAN on your 4500's for the server's physical connections, and uplink that to a "backend" interface on the CSS. This can be done with the CSS in either a router or bridge configuration, but I'd recommend router mode.

ISE redundant NICs

Similar Messages

Maybe you are looking for