topic Re: ISE 2.3 number of PassiveID PSN nodes in Network Access Control

ISE 2.3 number of PassiveID PSN nodes

tmlakar11 — Mon, 04 Dec 2017 10:15:39 GMT

Hi all,

I am setting up ISE in a large distributed environment with several pairs of PSNs at remote locations and one pair at HQ. The customer would like to use PassiveID/EC as a fallback auth mechanism.

I was wondering what is the max number of Passive ID nodes in the environment? Is it limited to 2 as is the case with pxGrid, or can it run on all (up to 50) PSNs in the deployment?

If it is limited to 2, than we can have dedicated PSNs in HQ, however I am afraid the solution will not work well for remote locations, since these use remote AD servers.

If it can run on all PSNs, I would like to run it on all PSNs, remote PSNs collecting logs from remote AD servers and reporting back to MNT at HQ.

Thanks in advance,

Cheers

Re: ISE 2.3 number of PassiveID PSN nodes

Charlie Moreton — Mon, 04 Dec 2017 12:11:26 GMT

From the Admin Guide:

Easy Connect is supported in High Availability mode. Multiple nodes can be defined and enabled with a Passive ID. ISE then automatically activates one PSN, while the other nodes remain in standby.

Cisco Identity Services Engine Administrator Guide, Release 2.3 - Manage Users and External Identity Sources [Cisco Ide…

Re: ISE 2.3 number of PassiveID PSN nodes

hslai — Tue, 05 Dec 2017 03:51:53 GMT

Re: ISE 2.3 number of PassiveID PSN nodes

tmlakar11 — Tue, 05 Dec 2017 09:34:47 GMT

Hi, I am not sure if the link helps. Based on that it seems that up to 50 can be dedicated as PID PSNs, however based on configuration guide only one will be selected as active, while the others will be standby.
Therefore it makes no sense to have more then just 2.

Thanks,