topic Re: ISE ERS API Rate/Payload Limiting in Network Access Control

ISE ERS API Rate/Payload Limiting

Damien Miller — Thu, 10 Jan 2019 16:37:43 GMT

Hello All,

I am wondering if there is any documentation pertaining to the ISE API's handling limits. We are testing out an automated inventory integration and every now and then the dev is reporting that there is a connection error. The similar set up we are migrating from is currently running against ACS without issue.

I know firepower has a limitation of 120 messages per second before you get a 429 too many messages error. It also provides a 422 back if you send messages greater than 2 MB. Does ISE have any similar limitations that we have to work with? Has any one here run in to similar issues when trying to add/change NADs?

In this link I found the following.
https://community.cisco.com/t5/security-documents/ise-ers-api-examples/ta-p/3622623
Known issues - If you're processing more than 100 records. These are enhancements.
CSCve05681 ERS Get-All takes very long time for response
CSCvg64354 ENH ISE ERS calls should be processed much faster

Re: ISE ERS API Rate/Payload Limiting

Jason Kunst — Thu, 10 Jan 2019 19:34:52 GMT

Please get your feedback into our Product managers using the feedback in the upper right of ISE. Not sure if we're going to have any more guidance than that right now

Re: ISE ERS API Rate/Payload Limiting

Nidhi — Fri, 11 Jan 2019 09:10:38 GMT

Damien,

We do not have anything published for ERS performance.

Thanks,

Nidhi

Re: ISE ERS API Rate/Payload Limiting

Nidhi — Fri, 11 Jan 2019 16:55:43 GMT

Also, just to add here, we are currently in process of evaluating performance matrix for API calls and will update the community once we have confirmed results.

Thanks,

Nidhi

Re: ISE ERS API Rate/Payload Limiting

dhook — Fri, 03 Apr 2020 15:56:26 GMT

Hello,

Just posted this in another thread: (just noticed that it was marked as spam, notified the moderator and hopefully it will be fixed).

https://community.cisco.com/t5/cisco-bug-discussions/cscvg64354-ise-ers-calls-should-be-processed-much-faster-2/m-p/4058458#M10737

The amount of data that usually is needed from the API is very small. The current design, although quite beautiful, is not very efficient. If you could add enhanced filtering and the availability to export a file, or a JSON/XML blob with the data that would make it a lot easier to work with the ERS API. It would not go all the way, but it would certainly make it a lot easier to extract information from the ISE.

Kind Regards,

//Dan

Re: ISE ERS API Rate/Payload Limiting

Damien Miller — Fri, 03 Apr 2020 19:10:02 GMT

This was an old thread. Since I first asked the question the BU has published ERS API scaling numbers for us, have you seen this?
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-1926029291

Are your results not consistent with the calls per second they are indicating?

Re: ISE ERS API Rate/Payload Limiting

Roberto.Carmona — Tue, 19 May 2020 21:50:33 GMT

As per this thread and the post from the BU, do you know what does number within the parenthesis means?

I assume the number the number outside, is the TPS, but not sure what's the meaning for the one within the parenthesis. Thoughts?

oncurrent ERS Connections

2.4= 10

2.6= 30

Operation	2.4 (3515)	2.4 (3595)	2.6 (3515)	2.6 (3595)	2.6 (3615)	2.6 (3655)	2.6 (3695)
EP Bulk create	361 (250K)	362 (250K)	351 (200K)	533 (200K)	351 (200K)	581 (200K)	598 (200K)

Regards,