I85PREP
⌘ K
Cisco 300-715 SISE study materials
Cisco 300-715 SISE study resources

Cisco 300-715 SISE: Deployment, Integration, and Troubleshooting

Cisco 300-715 SISE · Work through your exam, one topic at a time.

All guide sections

Deployment, Integration, and Troubleshooting

Deployment, Integration, and Troubleshooting

This domain tests the ISE deployment itself: node personas, distributed and HA design, certificates, external integration, backup/upgrade, monitoring, and troubleshooting tools. Questions often ask which node performs a role or which tool proves why a session failed.

Core rules

  • Personas are PAN (policy administration), MnT (monitoring/troubleshooting), PSN (policy services), and pxGrid. A standalone node runs all roles; a distributed deployment separates them and can have primary/secondary PAN and MnT.
  • Nodes register to the primary PAN. PAN auto-failover requires a secondary PAN. PSNs serve RADIUS/TACACS+/portal traffic and should be behind load balancers in large designs.
  • Certificates are role-specific: admin, portal, pxGrid, and node certificates. Use a trusted CA, correct SAN, and bind the certificate to the service.
  • Integration includes AD/LDAP, external RADIUS, PKI (OCSP/CRL), pxGrid, REST API (ERS/Open API), and MDM. APIs must be enabled and authorized.
  • Backup runs from the PAN to a repository; restore and upgrade planning depend on the deployment and version.
  • Troubleshooting starts with Live Logs and session details, then policy evaluation, profiler debug, TCP dump, support bundle, and alarms.

Worked example

A distributed deployment has primary/secondary PAN, primary/secondary MnT, and two PSNs. An engineer adds a third PSN. On the new node, the engineer sets DNS and NTP, imports a trusted CA chain, generates a node certificate, and binds it to the admin/portal/pxGrid services. The node is registered to the primary PAN. The Deployment page should show the node connected and the PSN service enabled. If it does not appear, check DNS resolution, time skew, certificate trust, and registration/ports before assuming a policy problem. After registration, the load balancer must include the new PSN, and Live Logs on that PSN should show sessions. The reasoning is that deployment health is a prerequisite for policy troubleshooting.

Traps

  • Treating PAN and MnT as interchangeable; backup and logging roles differ.
  • Forgetting NTP or DNS during node registration.
  • Using a certificate with the wrong SAN or an untrusted chain.
  • Running backup from a PSN instead of the PAN.
  • Enabling pxGrid without a valid pxGrid certificate.
  • Looking at reports when Live Logs are needed for a single failed session.
  • Assuming API access is on by default.