topic Re: Can 3515 to be used as a separate PAN and MnT in Network Access Control

Can 3515 to be used as a separate PAN and MnT

avallely — Wed, 06 Sep 2017 13:18:37 GMT

Hi,

customer looking to deploy 5400 User ISE deployments. The Sizing guide shows that the 3595 is used for separate PAN and MnT for large deployments, but does not cover any scenario using 3515 for small deployments. I plan to deploy 3515 as PSN at the remote sites.

Is 3515 supported in this scenario (i.e. 1 * 3515 as PAN and 1 * 3515 as MnT)

Many thanks.

Re: Can 3515 to be used as a separate PAN and MnT

Charlie Moreton — Wed, 06 Sep 2017 13:33:13 GMT

Yes. This is supported. It's not a scenario used in testing or scaling, so there will not be any numbers for you to use for deployment.

If you are going for a fully distributed deployment using 3515 appliances, I'd start with the same math that is used for the 3595 based deployment. In s standalone (Small Network) deployment, the 3595 can process up to 20,000 concurrent endpoints, whereas, in a Fully Distributed deployment, each PSN can process up to 40,000 concurrent endpoints.

It stands to reason (and these are NOT hard numbers), that since a 3515 based Small Network deployment can handle up to 7500 concurrent endpoints, then a Fully Distributed Deployment with 3515 appliances should be able to handle 15,000 concurrent endpoints per PSN.

This would initially be a 15,000 endpoint deployment:

2x 3515 for Admin (Primary and Secondary)

2x 3515 for MnT (Primary and Secondary)

2x PSN (for HA)

Of course, the actual numbers would be based upon your testing and use.

Re: Can 3515 to be used as a separate PAN and MnT

avallely — Wed, 06 Sep 2017 14:02:22 GMT

Thanks for your prompt response Charles.