ຄູ່ມືຜູ້ໃຊ້ຊອບແວ CISCO ISE

ຊອບແວ CISCO ISE

ເກີນview ຂອງ​ການ​ນໍາ​ໃຊ້​ສູນ​ກາ​ຕາ​ລິ​ສ​ຕິກ​ຫຼາຍ​

When you integrate more than one Catalyst Center cluster with a single Cisco ISE system, each Catalyst Center cluster is independent. No information is shared from any one cluster to any other. In this scenario, when Cisco Software-Defined Access (SD-Access) is deployed on Catalyst Center, the set of virtual networks (VNs) and all other SD-Access is local to each cluster.
Catalyst Center provides a mechanism to coordinate SD-Access and Group-Based Policy (GBP) elements across multiple Catalyst Center clusters integrated with a single Cisco ISE system. In order to allow global administration of SD-Access across multiple Catalyst Center clusters with a consistent set of VNs, the Multiple Catalyst Center feature leverages the existing secure connection with Cisco ISE to propagate VNs, security group tags (SGTs), Access Contracts, and Group-Based Access Control (GBAC) Policy from one cluster to another cluster. Cisco ISE takes the information learned from one cluster (known as the Author Node) and propagates it to the other clusters (known as the Reader Nodes).
The Multiple Catalyst Center feature is available when integrated with Cisco ISE Release 3.2 or later.

ໝາຍເຫດ

• The Multiple Catalyst Center operation is disabled by default. To use this feature, select the Enable Multiple Catalyst Center operation (under Advanced Settings) when integrating Catalyst Center with Cisco ISE. You can enable this feature at the initial configuration or at a later time (after Cisco ISE is already integrated). After this functionality is enabled, only deleting the Cisco ISE integration can disable the functionality.
• If you are using earlier releases of Cisco ISE, you must contact your account team to submit a request to the Cisco SDA Design Council for inclusion in the Limited Availability program. A Multiple Catalyst Center Limited Availability package will be made available to provided to allow access to the limited availability (LA) version of this functionality. See the Multiple Cisco DNA Center to Single Cisco ISE Prescriptive Deployment Guide for more information.

The Multiple Catalyst Center feature has specific role designations for the clusters:

• ຜູ້ຂຽນ Node cluster
• ກຸ່ມ Reader Node

ຜູ້ຂຽນ Node cluster

• ບົດບາດຂອງ Author Node ໄດ້ຖືກມອບໝາຍໃຫ້ກັບກຸ່ມທຳອິດ (ດ້ວຍຕົວເລືອກ Multiple Catalyst Center ທີ່ເປີດໃຊ້ງານ) ທີ່ປະສົມປະສານກັບການນຳໃຊ້ Cisco ISE, ຫຼືກຸ່ມທຳອິດທີ່ເປີດໃຊ້ຕົວເລືອກ Multiple Catalyst Center. ກຸ່ມ Author Node ເປັນຈຸດບໍລິຫານສໍາລັບນະໂຍບາຍກຸ່ມ (GBP) ແລະສໍາລັບ Cisco SD-Access ຂໍ້ມູນທົ່ວໂລກ. ກຸ່ມ Author Node ຈັດການ VNs, SGTs, ສັນຍາການເຂົ້າເຖິງ, ແລະນະໂຍບາຍ GBAC. ການສ້າງ, ດັດແກ້, ຫຼືການລຶບອົງປະກອບ VNs ແລະ GBP ສາມາດເຮັດໄດ້ພຽງແຕ່ຢູ່ໃນກຸ່ມ Author Node ເທົ່ານັ້ນ.
• ກຸ່ມ Author Node pushes ຂໍ້ມູນ VN ແລະ GBP ໄປຫາ Cisco ISE ຜ່ານ ERS (REST) APIs ສໍາລັບ Cisco ISE ເພື່ອໃຊ້ຂໍ້ມູນນີ້ ແລະເຜີຍແຜ່ໃຫ້ທຸກ Cisco Catalyst Center Clusters ໃນບົດບາດຂອງ Reader Node ຜ່ານ Cisco ISE pxGrid.
• ມີພຽງແຕ່ກຸ່ມດຽວເທົ່ານັ້ນທີ່ສາມາດຖືກກໍານົດເປັນ Node ຜູ້ຂຽນ. ມັນເປັນຂໍ້ດຽວທີ່ GBP ແລະຂໍ້ມູນ SDA ທົ່ວໂລກທີ່ຜູ້ໃຊ້ກຳນົດເອງ (ເຊັ່ນ: VNs ຫຼືນະໂຍບາຍ extranet) ສາມາດຈັດການໄດ້.
• ຖ້າ SGTs ຫຼື VNs ເຮັດວຽກຢູ່ໃນ Author Node, SGTs ຫຼື VNs ບໍ່ສາມາດຖືກລຶບໄດ້.

ກຸ່ມ Reader Node

• ກຸ່ມສູນ Catalyst ອື່ນໆທັງໝົດທີ່ມີຄຸນສົມບັດຫຼາຍສູນ Catalyst ຖືກເປີດໃຊ້ແມ່ນໄດ້ມອບໝາຍບົດບາດຂອງກຸ່ມ Reader Node. ກຸ່ມ Reader Node ມີແບບອ່ານເທົ່ານັ້ນ view ຂອງ VNs ແລະ SGTs.
• ເຖິງແມ່ນວ່າກຸ່ມ Reader Node ບໍລິໂພກແລະສືບຕໍ່ໃຊ້ VNs, SGTs, ສັນຍາການເຂົ້າເຖິງ, ແລະນະໂຍບາຍ GBAC ທີ່ຖືກກໍານົດໄວ້ໃນກຸ່ມ Author Node, ກຸ່ມ Reader Node ບໍ່ສະແດງສັນຍາການເຂົ້າເຖິງຫຼືນະໂຍບາຍ.
  VNs can only be created on the Author Node cluster. After created they are propagated to the Reader Node clusters, where they may be used in fabric provisioning operations. The Reader Node clusters configure the associated network attributes such as Virtual Network Identifies (VNID), Route Targets (RT), and Route
• Distinguishers (RD) which are local to that cluster.
  ຍົກເວັ້ນຄຸນສົມບັດ VN ແລະ GBP, ແຕ່ລະກຸ່ມ Reader Node ເປັນກຸ່ມເອກະລາດທີ່ຄຸ້ມຄອງໂຄງສ້າງເຄືອຂ່າຍຂອງຕົນເອງ.
• ຄຸນນະສົມບັດ Multiple Catalyst Center ຊ່ວຍໃຫ້ການຄຸ້ມຄອງນະໂຍບາຍທົ່ວໂລກໃນທົ່ວກຸ່ມ Cisco Catalyst Center ທີ່ປະສົມປະສານກັບ Cisco ISE ດຽວ. ຄວາມສາມາດນີ້ບໍ່ປ່ຽນແປງຂໍ້ຈໍາກັດພື້ນຖານຂອງການຈັດການເຄືອຂ່າຍສະເໝືອນ ແລະຜ້າຢູ່ໃນຫຼາຍກຸ່ມ Cisco Catalyst Center. VN ອາດມີຊື່ດຽວກັນໃນທົ່ວຫຼາຍກຸ່ມ Cisco Catalyst Center, ເຊິ່ງອະນຸຍາດໃຫ້ມັນສະຫນັບສະຫນູນສະມາຄົມຄວາມປອດໄພຂອງກຸ່ມ-VN ທີ່ສອດຄ່ອງໃນທົ່ວຫຼາຍກຸ່ມ. ແຕ່ໃນລະດັບກຸ່ມແຕ່ລະບຸກຄົນ, ຄຸນລັກສະນະຂອງເຄືອຂ່າຍຕົວຈິງທີ່ຈະເຊື່ອມໂຍງກັບ VN (VRF, ເປົ້າຫມາຍເສັ້ນທາງ, ຕົວແຍກເສັ້ນທາງ, ແລະອື່ນໆ) ແມ່ນບໍ່ຄືກັນໃນທົ່ວກຸ່ມ. ນີ້ແມ່ນຄືກັນກັບເວລາທີ່ປະຕິບັດການກຸ່ມສູນ Catalyst ເອກະລາດ.
• Up to four Catalyst Center clusters can be added as Reader Node clusters. Before adding a Catalyst Center node as a Reader, you must remove all admin-created Cisco SD-Access global data on the Reader Node cluster for Catalyst Center to integrate with Cisco ISE. This includes nondefault VNs (any VNs other than
  “DEFAULT_VN” and “INFRA_VN”, Extranet Policy, and so on). In the event there’s any nondefault GBP data (SGTs, Access Contracts, GBP), the user has the option to automatically clean up (delete) all nondefault GBP data, or to merge any GBP data not already present in Cisco ISE.

ໝາຍເຫດ

• Only five Catalyst Center clusters can be integrated with a single Cisco ISE deployment. This means one Author Node cluster and up to four Reader Node clusters.
• It’s possible to delete SGTs or VNs on the Author Node even when they are in use on Reader Nodes. In that event, the stale SGTs or VNs must be deleted manually on the Reader Nodes (after removing any references).

ການຄຸ້ມຄອງນະໂຍບາຍຂອງສູນ Catalyst ຫຼາຍ

ຫຼັງຈາກການເຊື່ອມໂຍງສູນ Catalyst ກັບ Cisco ISE ແລະເຮັດ synchronization GBP, ຂໍ້ມູນນະໂຍບາຍຈະຖືກ synchronized ລະຫວ່າງ Catalyst Center ແລະ Cisco ISE. ສິດທິໃນການຂຽນນະໂຍບາຍແມ່ນຢູ່ພາຍໃນ Catalyst

ສູນ. ປ່ອງຢ້ຽມ Cisco ISE ສໍາລັບການຄຸ້ມຄອງ SGTs, ກຸ່ມຄວາມປອດໄພ ACLs (SGACLs), ແລະນະໂຍບາຍ Egress ກາຍເປັນອ່ານເທົ່ານັ້ນ.
ທ່ານສາມາດຈັດການນະໂຍບາຍທີ່ອີງໃສ່ກຸ່ມ (ກຸ່ມຄວາມປອດໄພ, ສັນຍາການເຂົ້າເຖິງ, ແລະນະໂຍບາຍ GBAC) ໃນ Cisco ISE ແທນທີ່ຈະຢູ່ໃນສູນ Catalyst.
ໃນ Catalyst Center GUI, ຄລິກໄອຄອນເມນູ ແລະເລືອກນະໂຍບາຍ > ການຄວບຄຸມການເຂົ້າເຖິງກຸ່ມ > ນະໂຍບາຍ > ການຕັ້ງຄ່າ GBAC > ຈັດການການຄວບຄຸມການເຂົ້າເຖິງກຸ່ມໃນ Cisco ISE.

ອັບເກຣດຄໍາແນະນໍາສໍາລັບສູນ Catalyst ຫຼາຍ

ໃນສະພາບແວດລ້ອມຫຼາຍ Catalyst Center, ມັນແນະນໍາໃຫ້ດໍາເນີນການສະບັບຊອບແວ Catalyst Center ດຽວກັນໃນທົ່ວກຸ່ມຜູ້ຂຽນແລະ Reader Node ທັງຫມົດ, ຍົກເວັ້ນໃນລະຫວ່າງການຂະບວນການຍົກລະດັບ cluster. ທ່ານສາມາດອັບເກຣດກຸ່ມ Reader Node ທັງໝົດກ່ອນ, ແລະຫຼັງຈາກນັ້ນໃຫ້ອັບເກຣດກຸ່ມ Author Node ເພື່ອຫຼີກເວັ້ນຄວາມບໍ່ສົມດຸນຂອງຄຸນສົມບັດ ແລະຄຸນສົມບັດທີ່ບໍ່ເຂົ້າກັນໄດ້ໃນທົ່ວລຸ້ນຊອບແວ. ຫຼີກເວັ້ນການສົ່ງເສີມກຸ່ມ Reader Node ໃຫ້ກັບບົດບາດຂອງ Author Node ໃນລະຫວ່າງຮອບການອັບເກຣດ. ກຸ່ມ Catalyst Center ທັງໝົດຄວນໄດ້ຮັບການອັບເກຣດ ແລະແລ່ນຊອບແວເວີຊັນດຽວກັນກ່ອນທີ່ຈະສົ່ງເສີມກຸ່ມ Reader Node.
ຮູບທີ 1: ປັບປຸງຄໍາແນະນໍາສໍາລັບສູນ Catalyst ຫຼາຍ

The basic functionality of the Multiple Catalyst Center feature doesn’t require the same software version in all the participating Author and Reader Node clusters. However, using mismatched code versions may result in a difference in fixes, capabilities, and features between the clusters. The same Catalyst Center software version is recommended across all Author and Reader Node clusters.

ການນຳໃຊ້ສູນ Catalyst ຫຼາຍອັນ

ມີສອງທາງເລືອກໃນການນຳໃຊ້ຫຼາຍສູນ Catalyst.

A new deployment of multiple Catalyst Center clusters that aren’t currently integrated with Cisco ISE.
An existing Catalyst Center cluster that is integrated with Cisco ISE and new additional Catalyst Center clusters without Cisco ISE Integration.

ເປີດໃຊ້ສູນ Catalyst ຫຼາຍ

ການທໍາງານຂອງກຸ່ມສູນ Catalyst ຫຼາຍແມ່ນຖືກປິດໃຊ້ງານໂດຍຄ່າເລີ່ມຕົ້ນ. ມັນສາມາດເປີດໃຊ້ໄດ້ໃນລະຫວ່າງ ຫຼືຫຼັງຈາກການເຊື່ອມໂຍງກັບ Cisco ISE. ຫຼັງຈາກການເຮັດວຽກຂອງ Multiple Catalyst Center ຖືກເປີດໃຊ້, ທ່ານສາມາດປິດການໃຊ້ງານມັນໄດ້ໂດຍການຖອນການເຊື່ອມໂຍງ Cisco ISE ຢ່າງສົມບູນ.
The Multiple Catalyst Center operation requires pxGrid functionality. You can’t disable pxGrid after enabling Multiple Catalyst Center.

ຂັ້ນຕອນ

1. Step 1 In the Catalyst Center GUI, click the menu icon and choose System > Settings > Authentication and Policy Servers.
2. Step 2 Add Cisco ISE.
3. Step 3 Enter the required Cisco ISE information. For information, see Catalyst Center and Cisco ISE integration.
4. Step 4 Choose System > Settings > Authentication and Policy Servers > Add > ISE > Advanced Settings.
   ສະວິດການຕັ້ງຄ່າຂັ້ນສູງເປີດເຜີຍທາງເລືອກຂັ້ນສູງຕ່າງໆ, ລວມທັງສະຫຼັບເພື່ອເປີດໃຊ້ງານ Multiple Catalyst Center.
5. Step 5 Enable the Multiple Catalyst Center Operation option.
6. Step 6 (Optional) If you are editing an existing Cisco ISE integration, re-enter the Cisco ISE admin password.
7. ຂັ້ນຕອນທີ 7 ກົດ Add.

ການລວມສູນ Catalyst ຫຼາຍອັນກັບ Cisco ISE ດຽວ
ມີເງື່ອນໄຂເບື້ອງຕົ້ນສໍາລັບການລວມສູນ Catalyst ແລະ Cisco ISE ເປັນຄັ້ງທໍາອິດ. ສໍາລັບຂໍ້ມູນ, ເບິ່ງສູນ Catalyst ແລະການເຊື່ອມໂຍງ Cisco ISE.

ກ່ອນທີ່ທ່ານຈະເລີ່ມຕົ້ນ
When Catalyst Center is already integrated with Cisco ISE, complete the following steps to reintegrate Catalyst
Center and Cisco ISE after enabling the Multiple Catalyst Center operation. This allows Catalyst Center to negotiate the Author or Reader Node cluster role based on whether it’s a first node or subsequent node joining Cisco ISE with the Multiple Catalyst Center feature enabled.

ຂັ້ນຕອນ

1. Step 1 In the Catalyst Center GUI, click the menu icon and choose System > Settings > Authentication and Policy Servers.
2. Step 2 In the Actions column, hover your cursor over the ellipsis icon ( ) and choose Edit.
3. Step 3 Choose System > Settings > Authentication and Policy Servers > Add > ISE > Advanced Settings.
4. Step 4 Enable the Multiple Catalyst Center Operation option.
5. Step 5 Enter the Cisco ISE Admin password again.
6. Step 6 Click Add. Catalyst Center negotiates the Author Node role with Cisco ISE.
   • If the status of the configured Cisco ISE server displays “FAILED” because of a password change, click Retry, and update the password to resynchronize the Cisco ISE connectivity.
   • The status of the integration can be seen in the slide-in pane. Ensure that the integration Status displays as Active in the Authentication and Policy Server window.
7. Step 7 To verify the negotiated role of the cluster as the Author Node, choose System > Settings > System Configuration > Multiple Catalyst Center Settings.

ການເຊື່ອມໂຍງກຸ່ມສູນ Catalyst ອື່ນໆກັບ Cisco ISE ເປັນ Reader Nodes

ເພື່ອເຊື່ອມໂຍງກຸ່ມສູນ Catalyst ຕໍ່ມາກັບ Cisco ISE ດຽວກັນທີ່ມີການເປີດໃຊ້ສູນ Catalyst ຫຼາຍ, ກຸ່ມ Catalyst Center ຈະຕ້ອງບໍ່ມີ VNs ທີ່ບໍ່ມີຄ່າເລີ່ມຕົ້ນ (VN ໃດໆນອກເຫນືອຈາກ "DEFAULT_VN" ແລະ "INFRA_VN").

ກ່ອນທີ່ທ່ານຈະເລີ່ມຕົ້ນ
Verify that the cluster that you want to integrate includes only the default VNs under Policy > Virtual Network.

ຂັ້ນຕອນ

1. Step 1 In the Catalyst Center GUI, click the menu icon and choose System > Settings > Authentication and Policy Servers.
2. Step 2 Click Add and choose ISE.
3. Step 3 Enter the required Cisco ISE information. See Catalyst Center and Cisco ISE integration.
4. Step 4 Choose System > Settings > Authentication and Policy Servers > Add > ISE > Advanced Settings.
5. Step 5 Enable the Multiple Catalyst Center Operation option.
6. ຂັ້ນຕອນທີ 6 ກົດ Add.
7. Step 7 (Optional) When integrating the cluster with Cisco ISE for the first time, click Accept in the slide-in pane for Catalyst Center to accept the certificate pushed by Cisco ISE. Close the slide-in pane.
8. Step 8 In the Authentication and Policy Server window, verify that the status of the integration displays as Active.

ການລຶບເຄືອຂ່າຍສະເໝືອນ

ກຸ່ມ Author Node ບໍ່ຮູ້ການນຳໃຊ້ Virtual Network (VN) ໃນກຸ່ມ Reader Node. ທ່ານຕ້ອງລຶບການອ້າງອີງທັງໝົດຕໍ່ກັບ VN ໃນກຸ່ມ Reader Node ທັງໝົດກ່ອນທີ່ຈະພະຍາຍາມລຶບ VN ນັ້ນຢູ່ໃນກຸ່ມ Author Node. ຖ້າທ່ານລຶບ VN ຢູ່ໃນກຸ່ມ Node ຜູ້ຂຽນ, VN ຈະຖືກລຶບຢູ່ໃນໂຫມດຜູ້ຂຽນແລະໃນກຸ່ມ Reader Node ທີ່ບໍ່ມີການອ້າງອີງເຖິງມັນ. ແຕ່ຖ້າຫນຶ່ງຂອງ Reader Nodes ກໍາລັງໃຊ້ VN ນັ້ນ, ສະຖານະຂອງ VN ດັ່ງກ່າວຈະສະແດງເປັນ Out of sync ກັບຜູ້ຂຽນ. ທ່ານ​ຕ້ອງ​ໄດ້​ເອົາ​ການ​ອ້າງ​ອີງ​ທັງ​ຫມົດ (ສໍາ​ລັບ​ການ example, VN Addition in Host Onboarding Section ຫຼືການມອບໝາຍພອດຄົງທີ່) ຂອງ VN ໃນກຸ່ມ Reader Node ແລະຫຼັງຈາກນັ້ນດຳເນີນການລຶບ VN ນັ້ນຢູ່ໃນກຸ່ມ Reader Node.

ການລຶບກຸ່ມຄວາມປອດໄພ

ກຸ່ມ Author Node ບໍ່ຮູ້ຈັກການໃຊ້ກຸ່ມຄວາມປອດໄພຢູ່ໃນກຸ່ມ Reader Node. ທ່ານຕ້ອງລຶບການອ້າງອີງທັງໝົດຕໍ່ກັບກຸ່ມຄວາມປອດໄພໃນທຸກກຸ່ມ Reader Node ກ່ອນທີ່ຈະພະຍາຍາມລຶບກຸ່ມຄວາມປອດໄພນັ້ນຢູ່ໃນກຸ່ມ Author Node. ຖ້າທ່ານລຶບກຸ່ມຄວາມປອດໄພຢູ່ໃນກຸ່ມ Author Node, ກຸ່ມຄວາມປອດໄພນັ້ນຈະຖືກລຶບຢູ່ໃນກຸ່ມ Author Node, Cisco ISE, ແລະຢູ່ໃນກຸ່ມ Reader Node ຖ້າບໍ່ມີການອ້າງອີງເຖິງມັນ. ຖ້າຫນຶ່ງໃນກຸ່ມ Reader Node ກໍາລັງໃຊ້ກຸ່ມຄວາມປອດໄພນັ້ນ, ສະຖານະຂອງກຸ່ມຄວາມປອດໄພດັ່ງກ່າວຈະສະແດງເປັນ Out of sync ກັບຜູ້ຂຽນ. ທ່ານຕ້ອງເອົາການອ້າງອິງທັງຫມົດຂອງກຸ່ມຄວາມປອດໄພຢູ່ໃນກຸ່ມ Reader Node ແລະຫຼັງຈາກນັ້ນດໍາເນີນການລຶບກຸ່ມຄວາມປອດໄພນັ້ນຢູ່ໃນກຸ່ມ Reader Node.

ການສົ່ງເສີມບົດເລື່ອງຂອງຜູ້ອ່ານຕໍ່ກັບບົດບາດຂອງຜູ້ຂຽນ
ສະຖາປັດຕະຍະກຳການແກ້ໄຂສູນ Catalyst ຫຼາຍກຸ່ມມີຫຼາຍກຸ່ມ Catalyst Center ແລະມີພຽງແຕ່ກຸ່ມດຽວເທົ່ານັ້ນທີ່ສາມາດເປັນຜູ້ຂຽນນະໂຍບາຍໄດ້. ອາດຈະມີຕົວຢ່າງທີ່ Administrator ຕ້ອງການສົ່ງເສີມກຸ່ມ Reader Node ເພື່ອຮັບໜ້າທີ່ຂອງກຸ່ມ Author Node. ໂປຣໂມຊັນນີ້ຄວນຈະເຮັດໄດ້ເມື່ອ:

You are taking the Author Node cluster out of service or making it unavailable for an extended period of time.
The Author Node cluster is permanently unavailable or unresponsive for an extended period of time and policy changes are required during that time.

This promotion of a Reader Node to an Author Node can be done in two ways:

1. Graceful Promotion of a Reader Node to the Author role.
2. Force Promotion of a Reader Node to the Author role.

ການສົ່ງເສີມອັນສະຫງ່າງາມຂອງໂຫມດຜູ້ອ່ານຕໍ່ກັບບົດບາດຂອງຜູ້ຂຽນ
ທ່ານສາມາດສົ່ງເສີມກຸ່ມ Reader Catalyst Center ດ້ວຍຕົນເອງໃຫ້ກັບບົດບາດຂອງຜູ້ຂຽນໄດ້ ຖ້າຈໍາເປັນໃນການຕິດຕັ້ງ Multiple Catalyst Center. ກຸ່ມ Reader Node ທັງໝົດມີປຸ່ມ Promote to Author. ທ່ານສາມາດສົ່ງເສີມ

ກຸ່ມ Reader Node ໄປຫາ Author Node ໃນຂະນະທີ່ກຸ່ມ Author Node ປັດຈຸບັນຂອງທ່ານຍັງເຮັດວຽກຢູ່. ແນວໃດກໍ່ຕາມ, ຢ່າເລີ່ມປະຕິບັດການສົ່ງເສີມໃນຂະນະທີ່ກຸ່ມ Author Node ທີ່ມີຢູ່ແລ້ວຢູ່ໃນກາງຂອງກິດຈະກໍາການຂຽນນະໂຍບາຍຂອງກຸ່ມ (ສໍາລັບຕົວຢ່າງ.ample, ໃນຂະນະທີ່ synchronizing ນະໂຍບາຍກັບ Cisco ISE). ຖ້າກຸ່ມ Author Node ບໍ່ຫວ່າງ, ການປະຕິບັດການສົ່ງເສີມແມ່ນ staggered ຈົນກ່ວາ Author Node ສໍາເລັດການປະມວນຜົນໃນປະຈຸບັນ.

ໝາຍເຫດ

• Upon graceful promotion of a Reader Node cluster to the Author Role, the Reader Node cluster initiates a request to Cisco ISE for a role change (Reader to Author).
• When Cisco ISE receives the role change request, it requests the current Author Node to release the role of policy Author. The current Author node then releases the role of policy Author (if no sync in progress) and takes over the role of the Reader Node cluster.
• The current Reader Node that selected for promotion assumes the role of the Author Node. Upon the Author and Reader Role change, Cisco ISE updates the other Reader Node clusters about the new Author Node through a configuration update.

ຂັ້ນຕອນ

1. Step 1 On the Reader Node cluster, choose System > Settings > > System Configuration > Multiple Cisco Catalyst Center Settings and verify the Author and Reader Nodes.
2. Step 2 Click the Promote to Author button.
3. Step 3 Click Continue to promote the node to the Author Role.

ຂະບວນການປ່ຽນອາດຈະໃຊ້ເວລາສອງສາມນາທີ.

ບັງຄັບໃຫ້ໂປຣໂມຊັນຂອງ Reader Node ຕໍ່ກັບບົດບາດຂອງຜູ້ຂຽນ
ການສົ່ງເສີມການບັງຄັບແມ່ນຮູບແບບຂອງການສົ່ງເສີມຄູ່ມື, ເຊິ່ງມີຈຸດປະສົງຢ່າງເຂັ້ມງວດເພື່ອສົ່ງເສີມກຸ່ມ Reader Node ໃນປັດຈຸບັນໃຫ້ກັບບົດບາດຂອງ Author Node ໃນສະຖານະການເຫຼົ່ານີ້:

• The current Author Node cluster is out of service.
• The current Author Node cluster is nonresponsive.
• The graceful promotion of a Reader Node to the Author Role is taking more than 5 minutes.

ຮູບທີ 3: ບັງຄັບການສົ່ງເສີມຂອງ Reader Node ກັບບົດບາດຜູ້ຂຽນ

Do not use the force promotion option while the existing Author Node cluster is in service with a GBP authoring activity, as this may result in data loss and the Author Node cluster going out of sync with Cisco ISE. Therefore, force promotion is only recommended if you must restore service immediately and you are willing to risk losing data. After the forced promotion, the promoted Reader Node cluster will become the new Author Node cluster for the deployment. When the former Author Node cluster becomes available, it will transition to a reader role and download the latest configuration data from Cisco ISE.
Upon initiating the promotion of a Reader Node cluster, the Reader Node cluster initiates a request to Cisco ISE for a Role change (in other words, Reader to Author). When Cisco ISE receives the role change request, it requests the current Author Node to release the role of policy Author.

If the current Author Node is unresponsive and if the administrator selects Force Promotion, the Reader Node cluster ACA initiates a request to force the change of the Reader Node cluster to the Author Role and vice versa immediately in Cisco ISE. This configuration update message is sent to all the nodes.
The steps to force promote a Reader Node cluster to Author Node cluster are exactly the same as exlained in the graceful promotion of a Reader Node to the Author Role section. There is an additional step at the end to initiate the Force Promotion function.