A retail chain runs 120 stores, each with a Catalyst switch stack and two ISE policy service nodes in the back office. The security lead forbids adding any network appliance in the stores, and a single PSN outage must leave new 802.1X authentications running. Session state lives on each PSN instead of being shared, so which switch-side design should be used?

Listing both PSNs directly on each switch, with primary/secondary priority and a dead timer, provides the required failover without adding store appliances. When the primary stops responding, the switch marks it unavailable and sends new authentication requests to the secondary; each request is handled by a PSN that owns its local session state, rather than relying on shared state or a separate appliance. A centralized RADIUS proxy is a familiar way to simplify server selection, and it avoids adding equipment in stores, but stateless round-robin forwarding can send successive messages in an authentication exchange to different PSNs. Because session state is local, the second PSN may not be able to continue that exchange. Health-checked DNS with a short TTL can distribute traffic, but DNS changes are not a dependable RADIUS health-check and failover mechanism: switches may cache resolved addresses or resolve them only at configuration or startup, so a failed PSN can remain in use. Critical authentication is useful for maintaining limited access during a RADIUS outage, but it does not provide normal, successful new 802.1X authentication; it substitutes a locally defined fallback for authentication against ISE. Exam caveat: distinguish keeping already authorized devices connected from successfully authenticating new devices after a server failure. Practical check: test by making the primary PSN unreachable and verify from switch RADIUS counters and ISE logs that a fresh endpoint completes 802.1X against the secondary.