topic Re: ISE deployment with 9 PSNs in Network Access Control

ISE deployment with 9 PSNs

Przemyslaw Konitz — Thu, 21 Nov 2019 21:15:28 GMT

hi All,

I need someone to confirm one thing about deployment for 9 PSNs.

I remember from most of the presentations that whenever you have more than 5 PSN you need to split PAN from MnT

so how to interpret the following pictures?

different presentations

does the first one say that if I have 2x PAN/MNT (no pxGrid) + i.e. 9x PSN + 0xPxGrid subscribers - is that supported or not?

the 2nd one is old guide which means max of 5 PSN for 2x PAN/MNT

Re: ISE deployment with 9 PSNs

Damien Miller — Thu, 21 Nov 2019 22:23:05 GMT

If you have the PAN and MNT roles hosted on the same appliance/VM, then you can only have five additional nodes, 7 total including the PAN/MNTs. Any more than that and you need to put the PAN/MNT role on their own appliances or VM's.

In your case if you want 9 PSN's, then you need the PAN and MNT roles on their own dedicated nodes.

2x pan
2x mnt
9x psn

Re: ISE deployment with 9 PSNs

Arne Bier — Thu, 21 Nov 2019 22:27:35 GMT

I have to admit I had not seen the slide from that BRKSEC-2430 session - I can see the confusion here. It does say "15 Max Subscriber nodes in a combined PAN/MnT scenario".

When did that come about? I have seen customers do this in the wild, but I thought it was a non-compliant deployment model

Re: ISE deployment with 9 PSNs

Damien Miller — Thu, 21 Nov 2019 22:34:15 GMT

Those aren't PSN counts, those are pxgrid v1 connection limits per deployment model/size.

Re: ISE deployment with 9 PSNs

Arne Bier — Thu, 21 Nov 2019 22:42:42 GMT

@Damien Miller - thanks for clarifying that 😉

Re: ISE deployment with 9 PSNs

Przemyslaw Konitz — Fri, 22 Nov 2019 09:09:31 GMT

Thx Damien for reply,

a question though.

I though that in terms of pxgrid subscribes there was a limit of 4 of them

so how does that count?

Re: ISE deployment with 9 PSNs

Przemyslaw Konitz — Fri, 22 Nov 2019 09:12:14 GMT

ok I misunderstood what you wrote - pxGrid external connections / systems not the nodes itself. Right?

Re: ISE deployment with 9 PSNs

Jason Kunst — Fri, 22 Nov 2019 11:00:37 GMT

Pxgrid nodes count as nodes as you can see from his image

In a deployment of 5 psn nodes in a hybrid 2 could be designated out of the 5

In a large deployment you can use up to 4 out of the 50

Re: ISE deployment with 9 PSNs

Damien Miller — Fri, 22 Nov 2019 12:50:21 GMT

^this.

I can see how the confusion could start, in pxgrid we call connections subscribers. Overlapping terminology to psn nodes subscribing to the PAN.

Pxgrid subscriber = pxg connection
Psn subscriber = psn node

Pxgrid v1 had very poor scale, so it lists between 2 and 25 external "subscribers" (Max pxg connections). Unrelated to pxgrid/psn node count.