topic Re: Max number of Network devices for TACACS+ in ISE in Network Access Control

Max number of Network devices for TACACS+ in ISE

yongwli — Thu, 31 Aug 2017 04:23:28 GMT

Hi Team,

As we know, max number of network devices is 100K.

Two questions:

1. This number is a number based on performance experienced or it's a limitation in ISE software?

2. If defining 1 network device with IP range, IE /24 subnet, it exhausts 1 entry or 254 entries?

Thanks

Re: Max number of Network devices for TACACS+ in ISE

Charlie Moreton — Thu, 31 Aug 2017 11:42:14 GMT

1. This number is a number based on performance experienced or it's a limitation in ISE software?

- Database Limitation

2. If defining 1 network device with IP range, IE /24 subnet, it exhausts 1 entry or 254 entries?

- This counts as a single 'Device'

Re: Max number of Network devices for TACACS+ in ISE

yongwli — Thu, 31 Aug 2017 16:11:32 GMT

Thanks a lot!

Re: Max number of Network devices for TACACS+ in ISE

Craig Hyps — Thu, 31 Aug 2017 17:46:44 GMT

To clarify, a subnet range does not consume or equate to one NAD per IP. Only NADs that connect to ISE will have a cache entry. 100k is what we have validated in QA testing. This is not a hard limit, but certainly would not plan on exceeding. If know deployment will exceed, then recommend design for split clusters. Also recommend reach out to account team to submit requirements for higher scale so we know which customers actually require > 100k NADs.

/Craig

Re: Max number of Network devices for TACACS+ in ISE

yongwli — Fri, 01 Sep 2017 09:35:58 GMT

Hi Craig,

we have asked customer to do cluster split, does single PSN have a recommend number of network device? Then we could know how to split.

Thanks

Re: Max number of Network devices for TACACS+ in ISE

Craig Hyps — Fri, 01 Sep 2017 20:01:29 GMT

Sizing is based on transaction rate, not # NADs.

Re: Max number of Network devices for TACACS+ in ISE

kthiruve — Fri, 01 Sep 2017 20:53:25 GMT

Hi DL,

ISE supports upto 100 K Network device entries per deployment. This includes PAN, MnT and x number of PSN’s.

Question is if you want to calculate number of PSN’s this is based on TACACS+ TPS.

If the customer has ACS and is not oversubscribed you can easily replace an authenticating ACS server with an ISE PSN.

For more information on designing ISE deployment please see the how to guide that I just updated yesterday. It will walk you step by step how to design ISE deployment for TACACS+ with tables etc.

https://communities.cisco.com/docs/DOC-63880

You can also look at Craig’s breakout session on Scaling in 2016

https://communities.cisco.com/docs/DOC-63882

Thanks

Krishnan