topic ISE node group behind load balancer in Network Access Control

ISE node group behind load balancer

huangedmc — Mon, 11 Mar 2019 03:13:08 GMT

I'm trying to gather info on distributed deployment w/ multiple PSN nodes.

Having read through some documents, it looks like you can put multiple PSN's in a node group, and then place the node group behind a load balancer.

Q1:

Node group config requires multicast.

Cisco ACE LB doesn't support multicast, except in brige mode.

How do people support distributed deployment in node group behind Ciso ACE?

Q2:

User guide says: "We recommend that you have two, three, or a maximum of four nodes in a node group."

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_dis_deploy.html#wp1134272

What if we need more than 4 PSN nodes to support our network & user base?

Q3:

Has anyone been able to implement distributed deployment between two datacenters behind GSS?

If GSS isn't possible, we'll be happy to just have it in working state behind ACE LB.

thx!

ISE node group behind load balancer

nspasov — Wed, 20 Mar 2013 17:58:54 GMT

I have had close to zero experience with LBs so my answers will be limited:

Q1: I don't think the multicast plays any role with the LB. The multicast address is needed for the ISE nodes for replication

Q2: You will have to create a new node group with a new multicast address

Q3: No help here

Couple of other things to remember:

1. The nodes must be layer 2 adjacent

2. You must use routed mode...no NAT/SNAT. Each node must be reachable directly from the end clients

3. You must perform sticky

4. The Load balancers must be listed as NADs in ISE

Hope this provides some help to you.

Thank you for rating!

ISE node group behind load balancer

huangedmc — Wed, 20 Mar 2013 18:20:54 GMT

Thanks Neno.

Follow-up question:

Where do people usually place their ISE nodes? Internal or DMZ?

I heard they're typically put in the internal networks...

Why it's a good idea to keep ISE in the internal networks, instead of DMZ?

If guests can interface directly w/ the ISE, wouldn't it be safer to place it in the DMZ?

ISE node group behind load balancer

nspasov — Wed, 20 Mar 2013 18:27:03 GMT

You can place them in either. The trouble becomes with having to deal with all of the ACL rules that you have to manage. There are a lot of ports and protocols used by ISE. Also, it is not not uncommon for some of those ports to change with new releases

Thank you for rating!