topic Virtual ISE Hypervisor Redundancy in Network Access Control

Virtual ISE Hypervisor Redundancy

matrhebe — Wed, 25 Jul 2018 17:33:02 GMT

In a multi-node virtual ISE deployment, what is the recommendation for hypervisor redundancy?

Assuming all ESX host resources are equal, is it best to:

1-Pin each node/ise instance to a vmware blade (ESX host)
2-Use DRS (vMotion) allow ISE instances to move between blades (ESX hosts) freely

Not sure at this point if the nodes will be behind a LB or just individual nodes.

I think pinning them makes the most sense to ensure consistency, but want to know if there is a best practice.

Thanks!

Re: Virtual ISE Hypervisor Redundancy

Jason Kunst — Wed, 25 Jul 2018 19:31:04 GMT

I would recommend pinning them up. Especially with PSNs if one goes offline then the other can take over.

Load balancing is best of course as it gives you flexibility of bringing up and down PSNs for maintenance or scale changes

Re: Virtual ISE Hypervisor Redundancy

Jason Kunst — Wed, 25 Jul 2018 19:32:08 GMT

FYI vmotion is not currently supported, please see recent post in May
https://community.cisco.com/t5/identity-services-engine-ise/vmotion-support-for-ise/m-p/3445816#291295