topic Re: ISE SUPER MNT Question in Network Access Control

ISE SUPER MNT Question

hsangral — Fri, 12 Jul 2019 16:43:20 GMT

Hello All,

I wanted to know the benefits of using a Super MNT on ISE 2.4 ( 256 GB RAM).

As per BKRSEC 3699 the number of supported sessions would not change, the only benefit i see is faster reporting and Live log access.

Is there any sizing guide which talks about the scenarios where a Super MNT would fit

Thanks

Re: ISE SUPER MNT Question

Jason Kunst — Fri, 12 Jul 2019 17:20:51 GMT

That’s correct just better reporting performance if customer is experience lag. In 2.6 this is converted to a large appliance of VM for scaling up to 2M endpoints (this requires an admin node sized the same)

Re: ISE SUPER MNT Question

Damien Miller — Fri, 12 Jul 2019 17:40:06 GMT

Most of the focus on the Super MNT was the 4x increase of memory to 256 GB, I found that the real performance increase came when moving it to SSD storage.

I have a couple old testing numbers/slides that confirmed the same when moving to faster disk, Cisco generated slides.

Re: ISE SUPER MNT Question

hsangral — Fri, 12 Jul 2019 18:16:46 GMT

Thanks jason,

The reason I asked this question is one of the customer who is migrating from ACS to ISE had initially provisioned Large VM's for MNT's however due to licensing issue has to downgrade, The ACS is only performing device admin functionality for 20k Devices with 480k Tacacs and 50 k radius requests, I don't think downsizing should be an issue but wanted to confirm.

Re: ISE SUPER MNT Question

Jason Kunst — Fri, 12 Jul 2019 18:32:51 GMT

I don’t think that’s gonna be an issue. You can always set it up in a valuation for 90 days and see what happens and adjust your VM resources accordingly. Once the customer understands sizing you can tweak it and then purchase virtual machine license accordingly. I would think that the smallest size will be fine

Re: ISE SUPER MNT Question

Damien Miller — Fri, 12 Jul 2019 18:42:18 GMT

Look up SR# 686558774 if you have access to it, similar sized from NADs, on 2.4, and primarily TACACS with a little RADIUS, MNT issues.

Re: ISE SUPER MNT Question

hslai — Sat, 20 Jul 2019 19:04:06 GMT

Thanks, Damien. Our team is still investigating whether the performance issue of the report on T+ active sessions not fully resolved by re-enabling it in CSCvo61888. If anyone else running into slower M&T, please do open a TAC case with Cisco support.