The ticket
Switch sw-access-01 cannot reach RADIUS. Chat says “ISE is down.” The Admin GUI on 10.10.10.20 still opens. Live Logs are empty because you are not on MnT. The PSN at 10.10.10.21 is the one that answers UDP 1812.
PAN (Policy Administration Node) is where you write policy. PSN (Policy Service Node) is the RADIUS/TACACS brain the switch talks to. MnT stores logs and Live Logs. pxGrid shares context with firewalls and others. Official ISE 3.3: a node assumes Administration, Policy Service, Monitoring, and/or pxGrid personas. MnT does not take over PAN if PAN is down.
PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.
Four personas
Cisco’s deployment guide: the persona decides the services on that node. Admin portal menus change with the persona.
| Persona | What it does | This lab | If it dies |
|---|---|---|---|
| PAN | Write/publish policy, join AD, certs | 10.10.10.20 | Policy still runs on PSN; you cannot edit until PAN is back |
| PSN | RADIUS, guest, posture, profiling | 10.10.10.21 | New authentications fail on NADs pointed here |
| MnT | Log collector, Live Logs, reports | 10.10.10.22 | Auth may still work; you go blind |
| pxGrid | Share session/SGT with partners | on PAN in this lab | Firewall/Forescout stop getting ISE context |
Rebooting PAN because RADIUS timed out is the wrong box.
Admin GUI is not the RADIUS server. Live Logs live on MnT. The switch only cares about the PSN IP in radius server.
Standalone vs distributed
ISE 3.3: a node can run several personas. Lab often puts all on one VM. Production: dedicated PAN pair, dedicated MnT (Cisco recommends not combining MnT + PSN for optimum monitoring), one or more PSN groups behind the NADs.
Node ise-psn1
How you see it
Side A — NAD
test aaa group radius TECHCLICK\priya.hr LabPass new-codeon the switch. This hits the PSN, not the GUI.Side B — PAN
Administration → System → Deployment. Every node green. PAN is Primary.
Side C — MnT
Operations → RADIUS → Live Logs. If this GUI is empty but test aaa works, you are on the wrong node or MnT is sick — not “policy is gone.”
show aaa servers # RADIUS: 10.10.10.21 (PSN) State: UP test aaa group radius TECHCLICK\priya.hr LabPass new-code # User rejected / User successfully authenticated # This never prints the PAN IP. If it hangs, debug the PSN path.
Four persona failures
1 · GUI up, RADIUS dead
PAN is fine. PSN process or UDP 1812/1813 path is not.
2 · RADIUS works, Live Logs empty
MnT or logging target. Do not republish the whole policy first.
3 · PAN down, people panic
Existing policy stays on the PSN. You cannot edit. That is not an access outage by itself.
4 · Combined node in production
One reboot takes admin, RADIUS, and logs. Fine for this lab. Not for HQ.
How to prove it
1) You named the sick persona. 2) test aaa hits 10.10.10.21. 3) Live Logs show that test. 4) You did not reboot PAN for a PSN outage.
Traps
| Symptom | Persona | Wrong fix |
|---|---|---|
| GUI login fails | PAN / admin cert | Reload every PSN |
| Ports fail open/closed | PSN / NAD RADIUS | Rebuild policy sets |
| No Live Logs | MnT | “ISE is down” |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview
Sources
- ISE 3.3 Deployment — personas Administration, Policy Service, Monitoring, pxGrid.
- Techclick lab PDF Cisco ISE Identity-Based Network Access Control — persona impact, MnT ≠ PAN failover.
Related: ISE evidence desk · session factory · Forescout series.