You can choose the right ISE deployment based on the maximum scale numbers for active endpoints offered by specific deployment type, maximum scale numbers for active endpoints supported by individual PSN nodes and other relevant factors that are described in the below sections.

Every endpoint with unique MAC address is considered as one active session and the concurrent active sessions support is applicable for all types of sessions including Dot1x, Mab, Guest, BYOD, and Posture.

The maximum number of active sessions in the below table are derived based on tests under following conditions:

ISE deployments are formed in single datacenter deployed in same region, low latency (less than 5 ms) between the ISE internode communications, dot1xauthentications and accounting events generated by endpoints in the range of 2 to 4 repetitions per day, and majority of the sessions are RADIUS protocols authenticating with local ID providers.

ISE Deployment Scale

Policy Service Node Scale

*Cisco SNS 3795 is equipped with more RAM and better Disk Read/Write performance. It is best suited for dedicated PAN, dedicated MNT, or PAN/MNT personas and provides no added value when deployed as a dedicated PSN.

Note	SNS 3595 is supported in Cisco ISE Release 3.2 and earlier versions. SNS 3515 is supported in Cisco ISE Release 3.0 and previous versions. The number of maximum concurrent active endpoints supported by a dedicated PSN is 7,500 and a shared PSN is 5,000.

• You can choose small deployment for up to 50,000 concurrent active sessions and medium deployment for up to 150,000 concurrent active sessions.

• Large deployment is required for more than 150,000 concurrent concurrent active sessions. You must register MnT nodes as Dedicated MnT nodes in Large deployment.

• We recommend that you deploy PSNs closer to workload and Identity Providers (such as AD, LDAP) for performance sensitive loads.

• We recommend that you group PSNs for similar workload (for example, RADIUS Dot1x, Guest/BYOD, TACACS+) and distribute traffic through load balancer.

• For better performance, it is recommended to configure Calling-Station-ID (MAC) based stickiness in the load balancer.

• It is recommended to configure the PSNs in Node-groups if you are using the services that need URL redirect (for example, posture services, guest services, MDM, and so on).

• It is recommended to have multiple datacenters and group PSNs per datacenter. You can implement RADIUS (Primary/Secondary/Tertiary) failover on NAS devices. For example, if the primary datacenter (DC-A) fails, 50 percent NADs can failover to secondary datacenter (DC-B) and remaining NADs can failover to tertiary datacenter (DC-C).

• It is recommended to implement N+1 or N+2 redundancy within a PSN group.

• It is highly recommended to purge guest and inactive endpoints at regular intervals to avoid latency in ISE operations.

• The maximum concurrent active session values given above for each deployment are applicable for connected devices that are generating dot1x authentications up to 4 times a day.

• In case of deployments where endpoints generate repeated authentication and accounting events, more number of PSNs are required in PSN group to help in handling heavy traffic scenarios like simultaneous login events from huge number of users, Wi-Fi users roaming from one location to another, and so on.

• PSN node variations include TACACS+ PSN (T+PSN), TC-NAC PSN (TCNPSN), Guest PSN (GPSN), Cisco TrustSec PSN (CTSPSN), Security Group eXchange Protocol PSN (SXPSN), and PassiveID PSN (PIDPSN). For better performance, it is recommended to reserve TACACS+, RADIUS, Guest/BYOD workloads to dedicated PSN groups within a deployment.

• It is recommended to assign separate Cisco TrustSec PSNs (CTSPSNs) to handle TrustSec functions for TrustSec deployments to avoid overloading of RADIUS PSNs while pushing policies.

• For large scale NAC environments with huge number of Device Administration tasks (for example, heavy usage of scripts or Network management Systems), we recommend that you split the deployments and use a separate deployment for Device Administration (TACACS+).

The following table shows the authentication rates for RADIUS protocols when a Cisco ISE node acts as a single dedicated PSN in a deployment.

The following table shows the authentication rates for TACACS+ protocol when a Cisco ISE node acts as a single dedicated PSN in a deployment.

The following table shows the transactions per second (TPS) when Cisco ISE node is acting as a single dedicated PSN in a deployment for different scenarios.

The authentication values provided below may have + or - 5 percent deviation in production environment.

*Up to 300,000 NADs are supported. You must provide the network address and subnet in the Administration > Network Resources > Network Devices page.

**Having more than 500,000 guest users might create latency in user authentication.

***It is not recommended to have more than 600 authorization rules in a single policy set. Increasing the number of conditions per authorization rule might impact the performance.

This section specifies the time taken for Cisco ISE and pxGrid Direct server integration for different scales of endpoints and also the points to note during the endpoints synchronization.

Note

The above values are applicable only when the network latency between ISE and CMDB is less than 50 milliseconds. The above data is applicable for endpoints having around 10 attributes each. You might see Slow Replication alarms due to synchronization of endpoints across all the PSNs while downloading or replicating the data. It is recommended to schedule synchronization in batches (250,000 to 500,000 endpoints) to reduce the impact on incoming authentication rates. The resynchronization time for 100 endpoints is 1 second.

Cisco SNS hardware appliances support the Unified Extensible Firmware Interface (UEFI) secure boot feature. This feature ensures that only a Cisco-signed Cisco ISE image can be installed on the Cisco SNS hardware appliances, and prevents the installation of any unsigned operating system even with physical access to the device.

Note

Cisco ISE Release 3.1 Patch 6 and above and Cisco ISE Release 3.2 Patch 2 and above versions support Cisco SNS 3700 series appliances. You cannot add additional hardware resources like memory, processor, or hard disk to a Cisco SNS hardware appliance. Mixing SAS/SATA hard drives and SAS/SATA SSDs is not supported. You must use either SAS/SATA hard drives or SAS/SATA SSDs. SSD offers improved performance in disk read/write operations and other ISE operations like boot, installation (up to 10% improvement), upgrade database intensive tasks like backup and reports generation (up to 20% improvement). Note that the PSN performance for RADIUS and TACACS+ operations will remain the same as described in above sections. Additional Power Supply can be ordered separately for SNS 3615 and SNS 3715. For component part numbers, see Cisco Secure Network Server Data Sheet.

Cisco ISE can be installed on VMware servers, KVM hypervisors, Hyper-V, and Nutanix AHV. To achieve performance and scalability comparable to Cisco ISE hardware appliances, virtual machines must be allocated system resources equivalent to the Cisco SNS 3500 or 3600 series appliances as described in table below.

It is recommended that you reserve CPU and memory resources that match the resource allocation. Failure to do so may significantly impact Cisco ISE performance and stability.

For a VM deployment, the number of cores is twice the number of cores in a physical appliance due to hyperthreading. For example, in case of a small network deployment, allocate 16 vCPU cores to meet the CPU specification of SNS 3615, which has 8 CPU cores or 16 threads.

Deploy dedicated VM resources and do not share or oversubscribe resources across multiple guest VMs.

Cisco ISE is now available from the cloud, enabling you to scale your Cisco ISE deployments quickly and easily to meet changing business needs.

Cisco ISE is available as an Infrastructure as Code solution, helping you to rapidly deploy network accesses and control services anywhere.

Extend the Cisco ISE policies in your home network to new remote deployments securely through Amazon Web Services (AWS), Azure Cloud Services, or Oracle Cloud Infrastructure (OCI). AWS supports Cisco ISE Release 3.1 and later releases.

OCI and Azure Cloud support is available from Cisco ISE Release 3.2 and later releases.

See Deploy Cisco ISE Natively on Cloud Platforms and respective cloud documentations for resource specifications of supported instances.

Table below describes matrix of VM specification, cloud instances to their equivalent Cisco SNS appliances.

*This instance is compute-optimized and provides better performance compared to the general purpose instances.

**In OCI, you choose CPU in terms of Oracle CPU (OCPU). Each OCPU provides CPU capacity equal to one physical core of an Intel Xeon processor with hyper-threading enabled. Each OCPU equals two hardware execution threads known as vCPUs.

Extra Small Form Factor for Cisco ISE VM and Cloud Instances

Extra Small VM specification, 8 vCPU and 32 GB is available only on VMware servers such as KVM hypervisors, Hyper-V and Nutanix AHV and Cloud instances.

This specification is not available on SNS appliances.

The Extra Small form factor support is available from Cisco ISE Release 3.2 onwards.

Extra Small form factor ISE VM supports 12000 endpoints.

Only dedicated PSN persona is supported. Extra Small form factor node is not supported for large deployments and must not be deployed.

Extra Small form factor ISE VM performance for RADIUS and TACACS+ authentication is around 40 percent of that of Cisco SNS 3615.

For example, if the RADIUS authentication rate of Cisco SNS 3615 for PEAP-MSCHAP2 with internal user database is 150, this value will be 60 (40% of 150) for the Extra Small form factor ISE VM.