topic Re: pxgrid on PSN node doing radius in Network Access Control

pxgrid on PSN node doing radius

danhamil — Mon, 23 Apr 2018 13:29:59 GMT

Quick question for confirmation.

Can pxgrid persona be deployed on a PSN that is also doing radius? Or if it is deployed on PSN does it have to be dedicated pxgrid PSN and is not able to provide radius/profiling/device admin services?

Thanks,

-Dan

Re: pxgrid on PSN node doing radius

Timothy Abbott — Mon, 23 Apr 2018 14:15:59 GMT

Dan,

It can be deployed on a PSN accepting RADIUS requests however it is best practice for pxGrid nodes to be dedicated.

Regards,

-Tim

Re: pxgrid on PSN node doing radius

danhamil — Mon, 23 Apr 2018 14:22:52 GMT

Thanks Tim.

In the case where the customer only has 1 or 2 pxGrid subscribing clients and doesn't necessarily require a dedicates pxGrid node, is it better to deploy pxGrid persona on PAN/MnT node or PSN node doing radius in this case?

Thanks,

-Dan

Re: pxgrid on PSN node doing radius

jeppich — Mon, 23 Apr 2018 19:31:18 GMT

Hey Dan,

Please have your customer deploy pxGrid on dedicated nodes. There may be other caveats if you enable pxGrid on nodes with other personas.

For example, you may run into issues with pxGrid Active-Standby Failover. If both the pxGrid primary node and pxGrid secondary node are on nodes with other personas. If fail-over occurs, other services may affect how long the secondary pxGrid node comes up. Also how many concurrent users do you have ad how do you have ISE deployed. What pxGrid solution(s) is your customer looking at implementing and what version of ISE does your customer have.

Thanks,

John

jeppich@cisco.com