A packaging plant runs three Policy Service Nodes behind two PANs, but each switch lists a single PSN as its primary RADIUS server. When that node is patched, re-authentication stalls until it returns. The architect wants one address on every switch and traffic spread evenly across the nodes. Which deployment design meets both goals?
Select an answer to reveal the explanation.
Short Explanation
A load balancer gives you the single RADIUS address you want while still spreading the work. With source-IP persistence, each switch keeps reaching a consistent node, so session state stays predictable. It works like one reception desk routing arrivals to several open counters.
Full Explanation
A load-balancer virtual IP in front of the Policy Service Nodes gives every switch a single RADIUS server address while the balancer distributes Access-Request and accounting traffic across the pool. Source-IP persistence can keep a given switch landing on the same node, helping keep follow-up requests consistent. When a node is taken out of service and the balancer detects that it is unavailable, the balancer can remove it from rotation so surviving nodes can serve new requests. Listing every PSN in the switch server group provides local failover but does not by itself provide even distribution. Sending requests to the publisher would direct them to one node rather than distribute them across the PSN pool; PANs can also host the PSN persona, but that does not make a single publisher address a load-balancing design. DNS round-robin does not ensure even distribution or persistence, and resolver caching can delay changes. The balancer must handle UDP RADIUS with suitable persistence, and ISE node roles and certificate names must still match what the switch expects. Practical check: take one PSN out of service deliberately and confirm the balancer removes it while new authorizations continue on the remaining nodes.