Contents

Issue

You need to deregister a target node from the Cisco Identity Services Engine (ISE) deployment.

Environment

- Cisco ISE version: version 3.1 and later

- Deployment type: Distributed

- Policy Administration Node (PAN)

- Monitoring Node (MNT)

- Policy Service Node (PSN)

- Network Access Device (NAD), for example, switch or wireless controller

Resolution

Impact Assessment

- If deregistering the Primary PAN, promote a Secondary PAN to Primary first.

- The Primary PAN cannot be deregistered directly.

- If deregistering a PSN:

- Confirm a remaining PSN is available.

- Confirm NADs are configured to direct the RADIUS and TACACS+ authentications to remaining PSNs.

- Test authentication with remaining PSNs.

- If deregistering an MNT

- Confirm a remaining Monitoring node is available.

- Verify no sync operations are in progress on remaining nodes.

Before Deregistering

If you intend to rebuild and/or reregister the deregistered target node later, you must document the target node configuration before deregistering.

1. Take a full configuration backup of the deployment.

2. Document the target node ISE deployment settings:

1. Log in to the Primary PAN GUI.

2. Navigate to Administration > System > Deployment.

3. Check-mark the target node do be deregistered and select Edit.

4. Make notes or take screenshots of the entire configuration in both of the General Settings and Profiling Configuration tabs.

3. Document the target node system certificates:

1. Navigate to Administration > Certificates > System Certificates.

2. Expand the target node entry.

3. Make notes or take screenshots of the entire certificate configuration of the target node.

4. Select each certificate Used By the target node ISE components one at a time, and Export the certificates and private keys.

5. Make a note of the passwords you create when exporting each certificate.

- Note that you cannot re-import a certificate and key without the password.

4. Document the target node running system configuration:

1. SSH and log into the target node.

2. Run this command to show the running configuration and save the output to a text file.

show running-config

Deregistration Steps

1. Log in to the Primary PAN GUI.

2. Navigate to Administration > System > Deployment.

3. Select the target node to be removed.

4. Click Deregister.

5. Confirm the action when prompted.

6. Verify the node no longer appears in Administration > System > Deployment.

Cause

This process can be required for:

- Decommissioning or rebuilding ISE nodes.

- Hardware replacement.

- Topology changes.

- Resolving persistent synchronization / replication failures.

Related Content

- Export Configuration and Operation Data Backup from ISE

- Understand ISE 3.3 Node Registration Process