topic Re: pxGrid Scalability in Network Access Control

pxGrid Scalability

scamarda — Wed, 08 May 2019 11:29:12 GMT

In the Performance and Scale document as well as the individual ISE version documentation, the only pxGrid scale measurement is the amount of subscribers a node supports (node size and deployment method). I interpret a pxGrid subscriber to be an ISE Node, Stealthwatch, Firepower, Infoblox, DXL etc. Should I be concerned about query or publish rates with a large number of Active and Passive authentications? Will the numbers change with pxGrid v2 and ISE becoming a subscriber?

Re: pxGrid Scalability

Aravind Ravichandran — Wed, 08 May 2019 12:20:13 GMT

Please verify this slides http://cs.co/BRKSEC-3432

Maximum dedicated pxGrid node is 4 & maximum subscribers per pxGrid node are 200.

Re: pxGrid Scalability

scamarda — Wed, 08 May 2019 13:26:21 GMT

Thanks for the reply. I have seen that document as well. My original question was "Are the number of subscribers the only measurable to consider in sizing a pxGrid deployment?" If I have 400,000 users (across 4 3695 PSN), and three subscribers (Firepower, Stealthwatch and DXL). We only a small amount of subscribers but a large number of users do I just care about the number of subscribers connecting to the pxGRid node?

Re: pxGrid Scalability

Aravind Ravichandran — Wed, 08 May 2019 13:44:39 GMT

Yes, only subscribers have to be considered for pxgrid scaling.

If you have only 3 subscribers I guess you can run pxgrid on the PAN node itself but not tested on this one.

Re: pxGrid Scalability

jeppich — Mon, 20 May 2019 14:40:17 GMT

Hey Sam,

Stealthwatch, Firepower, McAfee DXL, all use pxGrid 1.0. The customer should really have pxGrid dedicated nodes. Since this is pxGrid 1.0, you can only have 2 pxGrid nodes per ISE deployment. This would be an active/standby scenario.

Please email me directly, i would like to get more information on your customer's deployment.

Thanks,

John

jeppich@cisco.com