topic Re: Starting with ISE in Network Access Control

Starting with ISE

kamarale — Tue, 19 Feb 2019 20:49:32 GMT

Hello,

If I need a Installation of ISE as VM in for a production enviroment. Which OVA file should I download?
These are the licenses I have:
R-ISE-VMS-K9=
L-ISE-BSE-P2

ISE-2.2.0.470-virtual-SNS3515-200.ova --- ISE 2.2 OVA file - Virtual SNS-3515 200GB (recommend for PSN or PxGrid)

or this ISO

ise-2.2.0.470.SPA.x86_64.iso --- Cisco ISE Software Version 2.2.0 full installation...

I do not know if one of those would be correct, or if I need to download and install another...

Thank you in advance.

Kind Regards.

Re: Starting with ISE

Damien Miller — Tue, 19 Feb 2019 21:42:10 GMT

If you are building a brand new deployment that will go in to production then I would recommend the 2.4 with a 600GB disk. The PAN/MNT roles should be on nodes with at least 300 GB. If there is a specific reason you are choosing 2.2, you can still run this release but 2.4 is the common recommendation now.

ISE-2.4.0.357-6.5OVA-SNS3515-Small-600GBHD-16GBRAM-12CPU.ova

This ova will be the easiest option for you as it is deploy and go. If you use the ISO file you have to build the VM template yourself, the install takes a bit longer.

Re: Starting with ISE

kamarale — Wed, 20 Feb 2019 12:17:44 GMT

Hello,

there are going to be only two ISE VM (one primary and one secondary) , both with the 3 mandatory personas.

It is a small deplyment, only 500 end devices and with BASE license.

Would you still recomend that OVA with 600GB of HDD?

Is there a lot of diference in the configuration/GUI between 2.2 and 2.4?

The process would be to install the OVA and then , with data obtained with show udi, download the license from Cisco and apply it right?

Thank you all.

Regards.

Re: Starting with ISE

Damien Miller — Wed, 20 Feb 2019 15:09:51 GMT

There are differences in how the policy sets are displayed and configured. It will better position you for future upgrades and likely have longer support / end of life runout than the older 2.2 version. 2.4 is the suggested release to be on and you did purchase 2.4 vm licenses.
https://community.cisco.com/t5/security-blogs/announcing-the-quot-suggested-release-quot-status-of-ise-2-4/ba-p/3775587

The disk space guidelines can be found in the 2.4 install guide. While you can run PAN/MNT/PSN in the lab on 200 GB it is not recommended for production, you will likely run in to issues later. See the column for "Minimum Disk Space for Production" and "Recommended Disk Space for Production". The first row for standalone deployment is relevant to you.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_01.html#ID-1417-00000127

The license information will also be shown in the admin node GUI licensing page once you have registered both nodes. Your understanding is correct here, you will take that information, enter it while fulfilling the PAK key on cisco.com, then upload the license file generated on your ISE licensing page.