ISE server down scenario Network access on Meraki MS

[ZeeBoussaid]

hello, 

we use multiple MS-225 for production and all endpoints are authenticating via ISE. if a machine failed the authentication I created a Vlan500 where it just "sits" there with no valid IP. my question is simple: in case of a catastrophic ISE failure and the radius server is down, how my endpoints can access the network? I know on the cat switches it was easier, if the machine is unable to reach ISE, the port will be open and the machine will connect to the network, in the Meraki MS, if ISE is not reachable, the port will not be opened and like i mentioned the machine will automatically be assigned to Vlan 500. and before you ask if simply to delete the Vlan 500, well I added it to prevent unauthorized non-domain machines from accessing the network on LAN. 

[cmr]

@ZeeBoussaid I'd give VLAN 500 internet access only, so at least people would have something and you wouldn't be risking the corporate LAN.  Also make sure you have an HA ISE setup so it doesn't completely fail, as you would with DNS and domain controllers etc.

[ZeeBoussaid]

We do have HA in place, I was just trying to be prepared for the worst case scenario where both Radius servers are down for whatever reason. I like to be prepared. Thank you for the advice. 

[PhilipDAth]

They can't.

[KarstenI]

I think this could be done with the help of the API. A monitoring station checks for RADIUS-functionality on both PSNs. If both are offline you issue an API call to change the port-settings to something useful in that situation.

[ZeeBoussaid · Accepted solution]

just an FYI, i installed a new MS225 and blocked its MAC from ISE to replicate that ISE not responding, i had one machine with the applied access polices applied connected to the switch, and once the machine could not authenticate with ISE, the laptop had access to the internet and that's what we wanted. the VLAN 500 is defined in ISE, and since the MS is blocked, the 500 Vlan policy no longer applies.