No, I do not promote the second instance as primary. The guest network should be set up redundantly. There is one ISE at each of the different locations. These ISE instances are in one deployment. Both IP addresses are entered as radius servers on the WLC. If I switch off an ISE instance, I am also redirected to the correct self-registration portal. That works so far. The guest can also register here and the request can be recognized and approved in the sponsor portal. I can't say whether I can then connect to the network when I click on approve in the sponsor portal and then get the credentials, I haven't tested it yet, but I think I can. The problem I have here is that no approval mails are sent out when a node goes down. According to your link, the guest access can also be found on the PSN and not on the PAN. I would just like to have redundancy in case an instance goes down, so that everything still works normally for the user.
I have two sponsor portals due to redundancy. I know that the portal runs on both instances. However, the problem is that several IPs can be assigned in the DNS, but these are processed in a round-robin procedure. In other words, if one instance fails, the DNS server usually doesn't notice because it has no health checks and could then forward the traffic to the wrong IP. For this reason, there are two portals. One points with the IP to one ISE and the other with the IP to the other ISE.
