topic Re: ISE distribute deploy questions, 10 nodes, can deploy mix PAN and Mnt ? in Network Access Control

ISE distribute deploy questions, 10 nodes, can deploy mix PAN and Mnt ?

BAOHUA — Wed, 29 May 2019 03:35:23 GMT

Hi team

Just want to know about ISE distribute deploy questions.

Environments:

Almost 150k endpoints
Ten 3595 ISE appliances

The question is that we plan to distribute deploy ISE ,2 for PAN&MnT ,2 for PxGrid, 6 for PSN , no profiling so far . Is this deployment validated? What is the best practices in this requirement?　If will enable profiling in the future, whether the MnT should be dedicate deploy ?

I only saw this

as I marked in yellow . Does it means when PAN and Mnt on same node that the dedicate PSN will only maximum 5 PSNs ? as I marked in blue , Does it means we should deploy role node by dedicate when we want to deploy PSN exceed 5 nodes ? as i asked , whether we can't mix PAN and MnT when want to deploy 6 PSNs ?

Any feedback will be appreciate .

Re: ISE distribute deploy questions, 10 nodes, can deploy mix PAN and Mnt ?

Damien Miller — Wed, 29 May 2019 15:14:50 GMT

Your picture won't load for me, but what you proposed is not a supported deployment model. A hybrid design with the PAN/MNT personas collocated on the same two nodes has a max of 5 PSNs.

So as you were already suspecting, if you want 6 PSN's and 2 PXG nodes, then you have to have your PAN and MNT personas on different nodes, a dedicated deployment.
You would have a total of 12 nodes;
2x PAN (HA)
2x MNT (HA)
6x PSN
2x PXG

Re: ISE distribute deploy questions, 10 nodes, can deploy mix PAN and Mnt ?

Francesco Molino — Wed, 29 May 2019 03:18:03 GMT

Hi

I don't see your picture.
You can check the following link: https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--1312516075

You'll see your design isn't supported.

Re: ISE distribute deploy questions, 10 nodes, can deploy mix PAN and Mnt ?

BAOHUA — Fri, 31 May 2019 05:46:01 GMT

Many thanks