topic Re: Cisco ISE distributed deployment in Network Access Control

Cisco ISE distributed deployment

Debabrata Majhi — Wed, 28 Nov 2018 04:30:55 GMT

We have two ISE in different subnet and location.Can we make it as single cluster?

Is it certificate mandatory ?

What are the prequation needs to be taken care?

Can any one help me

Debu

Re: Cisco ISE distributed deployment

Surendra — Wed, 28 Nov 2018 07:32:45 GMT

Answer to your first question, Yes, you can have two ISE nodes in different subnets and locations as long as you allow the ports mentioned here between the nodes https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_0110.html

Answer to your second question, Yes, certificates are mandatory as the registration happens over secure HTTP tunnel.

For the third question,
Recommend you to follow this https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_011.pdf

Re: Cisco ISE distributed deployment

Debabrata Majhi — Wed, 28 Nov 2018 12:24:43 GMT

Hi Surendra

Thanks for your prompt response.

Apricate your help

Hi Surendra

Thanks for your prompt response.

Appreciate your help. Just to understand

If there is any existing ISE cluster already running, can we move one node from existing ISE cluster for new location, is it possible?

Is there any licensing issue ? If I change the IP address

If possible What Shall we do

Unregister the server from existing cluster
Change the ISE IP according to new location
Again join the node in cluster

Am I right? Or please guide me proper steps

Thanks

Re: Cisco ISE distributed deployment

Surendra — Wed, 28 Nov 2018 12:34:04 GMT

You can do that as long as you have connectivity. No additional licenses are required.

Re: Cisco ISE distributed deployment

Debabrata Majhi — Wed, 28 Nov 2018 12:51:28 GMT

Hi Surendra

Thanks

In that case ,I have to follow the following steps right?

Unregister the Node from existing cluster
Change the ISE IP according to new location
Again join the node in cluster

Thanks

Re: Cisco ISE distributed deployment

Debabrata Majhi — Tue, 04 Dec 2018 13:18:50 GMT

Hello Surenda

Is there any Delay which needs to be match ,If the server is defferent location/Subnet?

Thanks

Debu

Re: Cisco ISE distributed deployment

Surendra — Tue, 04 Dec 2018 13:41:29 GMT

200ms is the tolerance.

Re: Cisco ISE distributed deployment

Jason Kunst — Tue, 04 Dec 2018 14:28:39 GMT

please see https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-798633198

Re: Cisco ISE distributed deployment

paul — Tue, 04 Dec 2018 19:02:16 GMT

200 ms was the old guidance. In 2.1 and later it was change and to 300 ms. Of course there are other factors other than latency.

Re: Cisco ISE distributed deployment

Debabrata Majhi — Wed, 05 Dec 2018 08:41:10 GMT

Thanks Paul and all for make it sence ,

Paul,Can your please let me know some example of "other factors" which needs to be consider.Which will help us to design the cluster.

Thanks

Re: Cisco ISE distributed deployment

Jason Kunst — Wed, 05 Dec 2018 13:09:31 GMT

Have you reviewed scale and high availability or ise tips tricks

https://community.cisco.com/t5/security-documents/ise-training/ta-p/3619944#toc-hId-1281981443