topic ISE Deployment design in Network Access Control

ISE Deployment design

atiye.bigdeli — Fri, 21 Feb 2020 19:06:24 GMT

Hi friends.

We want to design the Cisco ISE deployment for the network with the 1000 Clients. (only radius not tacacs).

the node are only wire and there is no wireless node.

which VM deployment size should we use? and should use the distributed design for 1000 node or standalone?

Best Regards

Re: ISE Deployment design

yalbikaw — Sun, 02 Jun 2019 21:56:26 GMT

Hello 🙂

please check this link for perfomance and scale.

https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--1069292324

it will show you each sns or equivalent vm and how much they can handle.

regarding standalone or distributed, it really depends on the infra.

its nice to have 2 node deployment for redundancy check this document as well

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_00.pdf

Wishes,

Re: ISE Deployment design

Damien Miller — Sun, 02 Jun 2019 22:03:55 GMT

You should plan for two 3515 or 3615 vm templates in a standalone HA cluster. These are good to support 7500 or 10,000 endpoints (3515 vs 3615), more than enough capacity for your endpoint count.

Having two nodes doesn't increase the scale any in a standalone deployment topology, but will allow you to perform maintenance functions with lower impact.

3615's are new for 2.6 and supported with this version, support 10k active endpoints.
3515 which is supported on either 2.4 or 2.6. 7500 or 10k supported active endpoints.

Re: ISE Deployment design

atiye.bigdeli — Fri, 07 Jun 2019 08:30:35 GMT

Thank you for your answer.

I have another question. should I buy the license related the vm size?

Regards.

Re: ISE Deployment design

Marvin Rhoads — Sun, 09 Jun 2019 03:40:25 GMT

You license the VM(s) based on its size (medium is the most common) and then separately license the deployment based on the number of endpoints and features needed (Base, Plus, Apex, and/or Device Administration).