Phase 1: Core Deployment

In this phase, we will move from initial hardware preparation to a fully functioning, dual-node ISE cluster.

Initial Appliance Setup

The first step in any ISE deployment is the "Day 0" setup of the underlying hardware.

1. IP Configuration: Assign static IP addresses to the management interfaces of both 3715 appliances.
2. Hostname & DNS: Configure unique hostnames and ensure both nodes can resolve their own FQDNs and the FQDN of the peer node.
3. NTP Configuration: Set up NTP synchronization immediately. As mentioned in the Introduction, time accuracy is paramount for ISE.
4. Initial OS Setup: Complete the basic Cisco ISE installation wizard to reach the web-based administration GUI.

Configuring Personas

This deployment uses a "Full Node" approach where every appliance provides every service. This is a common strategy for small-to-medium deployments looking for maximum redundancy.

Persona Roles

• Administration (Admin): This persona provides the web interface for configuration and the backend for managing the ISE database.
• Monitoring (MNT): This persona manages the collection and storage of logs, reports, and analytics.
• Policy Service Node (PSN): This is the "workhorse" persona. It handles all RADIUS/TACACS+ authentication and authorization requests, as well as posture enforcement.

Assignment Process

To achieve our goal, we will perform the following on both nodes:

1. Navigate to Administration > System > Deployment.
2. Select the node.
3. Enable the Administration, Monitoring, and Policy Service checkboxes.
4. Save and allow the node to restart the necessary services.

High Availability & Redundancy Basics

By configuring both nodes with all three personas, we create a resilient environment.

• Service Redundancy: If Node A fails, the network access devices (switches/WLCs) should be configured to failover to Node B for RADIUS requests.
• Database Synchronization: ISE automatically synchronizes the configuration database and monitoring data between the nodes.
• Redundancy Note: While the personas are redundant, ensure your network design (e.g., redundant uplinks to the switches) supports this level of ISE availability.