topic Re: Installing Cisco ISE 2.4 on Azure in Network Access Control

Installing Cisco ISE 2.4 on Azure

nathant — Sun, 23 Sep 2018 02:46:13 GMT

Is it possible to install Cisco ISE 2.4 on Microsoft Azure? If so, could someone please provide instructions on how to achieve this? Is Cisco ISE 2.4 supported on Microsoft Azure yet?

Re: Installing Cisco ISE 2.4 on Azure

Francesco Molino — Sun, 23 Sep 2018 03:21:27 GMT

Hi
There's no official support for Azure and AWS as far as I know.
However, if both can run VMs on a supported hypervisor, it will work.
Here the link for supported hypervisors:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/install_guide/b_ise_InstallationGuide23/b_ise_InstallationGuide23_chapter_01.html#hypervrequirements

As you can see ESX, Hyper-V and KVM are supported. I've never personally installed ISE on Hyper-V but the other 2 work like a charm.

Re: Installing Cisco ISE 2.4 on Azure

Damien Miller — Sun, 23 Sep 2018 04:28:31 GMT

I actually just posted a question on running ISE in the cloud a few weeks ago, wondering if anyone had tried it.
https://community.cisco.com/t5/identity-services-engine-ise/ise-in-the-cloud/td-p/3703425

As Francesco indicated, hyper-v is a supported platform for ISE, and Azure does allow nested virtualization in some compute models.

I think it will work, but I'm not sure if anyone has really tried it yet. What I did find is that you will have to create static NAT rules on the azure host VM, this might be the complicated part. If you try it, I'd love to hear some feedback on how it went.

Re: Installing Cisco ISE 2.4 on Azure

MajidShirzadeh — Thu, 25 Oct 2018 22:09:54 GMT

Were you able to find more info on this ?

Re: Installing Cisco ISE 2.4 on Azure

Damien Miller — Thu, 25 Oct 2018 22:42:32 GMT

I don't have any good news for you right now in regards to Azure. You could certainly run ISE in AWS with vmware cloud since they give you esxi on bare metal. At this point I would not run ISE on nested hyperv. You would have to NAT / port forward on the host hyperv server, ISE would not be given a directly accessible Azure IP. You can assigned a nested VM a static IP, but it's internal to the nested hyperv switch, thus the need for host nat rules.