topic Re: Maximum SGACLs in Network Access Control

Maximum SGACLs

omadrile — Thu, 02 Aug 2018 10:42:59 GMT

Hi team,

In this document ISE Performance & Scale | Cisco Communities it's mentioned that the maximum number of SGACLs supported in ISE 2.2 was 2500, and it seems it's decreased to 1000 in ISE 2.4, is that correct or a doc typo? On the other hand, do we have any limits in terms of maximum Source / Destination SGTs supported when creating the TrustSec Policy Matrix?

Thanks,

Oriol

Re: Maximum SGACLs

Timothy Abbott — Thu, 02 Aug 2018 15:30:09 GMT

I'm checking with the author of the doc to be sure but it does seem we have rolled back the amount of SGACLs. I'll update once I hear back. As for the second part of your question, I'm not sure I understand. Could you elaborate?

Regards,
Tim

Re: Maximum SGACLs

Craig Hyps — Thu, 02 Aug 2018 17:01:17 GMT

Performance and Scale page updated.

Re: Maximum SGACLs

omadrile — Thu, 02 Aug 2018 18:10:11 GMT

Thanks for your reply Tim. What I meant in the second question is whether there's a max NxN dimension limit for the TrustSec Policy Matrix in ISE. Given that the max number of SGTs in ISE 2.4 is 10000, does that mean that the max dimension for such matrix is 100 x 100 ?

Re: Maximum SGACLs

jeaves@cisco.com — Fri, 03 Aug 2018 07:09:15 GMT

Hi,

if you have N number of SGT's added into ISE then the matrix will have N rows and N columns. So, the matrix will be N x N.

So, in ISE 2.4 there is now a limit of a 10k x 10k matrix BUT that would be for a very very special use-case.

Most customers are using less than 250 SGTs, almost all are using less than 500. Some customers are using 2000 SGTs but we know exactly what platforms they are using and have worked through it carefully. You can have large no.s if the specific infrastructure and use cases are carefully understood.

We do support multiple matrices in ISE so you could maybe have a matrix per use case and we do have custom matrix views plus a tree view to make management easier.

Normally keeping it simple to meet the customer needs is the way to go.

Regards, Jonothan.