topic Re: TACACS+ Performance question in Network Access Control

TACACS+ Performance question

yongwli — Thu, 31 Aug 2017 04:16:26 GMT

Hi Team,

How many rules is below table based on?

ISE TACACS+ Performance

Platform performance specs are for a dedicated PSN.

PAN and MNT nodes are deployed as separate node(s).

Scenario	Cisco SNS-3415 Appliance	Cisco SNS-3495 Appliance	Cisco SNS-3515 Appliance	Cisco SNS-3595 Appliance
ISE Version	ISE 2.0	ISE 2.0	ISE 2.1	ISE 2.1
TACACS+ Function: PAP	1,400 / second	2,800 / second	3,236 / second	4,884 / second
TACACS+ Function: CHAP	1,500 / second	2,900 / second	2,413 / second	4,961 / second
TACACS+ Function: Enable	700 / second	1,200 / second	1631/second	1,984 / second
TACACS+ Function: Session AuthZ	900 / second	1,700 / second	2,191 / second	3,453 / second
TACACS+ Function: Command AuthZ	900 / second	1,700 / second	2,359 / second	3,467 / second
TACACS+ Function: Accounting	2,900 / second	4,900 / second	3,209 / second	9,128 / second

Thanks

Re: TACACS+ Performance question

Craig Hyps — Thu, 31 Aug 2017 17:14:08 GMT

Would require some digging to learn from QA the size of specific rule set used in testing, but I would ask if there is a specific concern over the size of rule set you are using.

Craig

Re: TACACS+ Performance question

yongwli — Thu, 31 Aug 2017 17:27:26 GMT

Customer cannot provide policy number at this time, but since they have more than 60K network device, and need to use different condition for different type of network device or location. So policy number will be larger as they said.

Re: TACACS+ Performance question

Craig Hyps — Thu, 31 Aug 2017 18:16:20 GMT

Refer here for policy table limits: ISE Performance & Scale

Re: TACACS+ Performance question

yongwli — Fri, 01 Sep 2017 06:29:15 GMT

Hi Craig,

Customer don't have oversize policies, just need to know the performance number we list based on how many rules. 1 rule or 100 rules? Did you mean the performance number I list in first post is based on max policy number?

Thanks

Re: TACACS+ Performance question

kthiruve — Fri, 01 Sep 2017 20:59:25 GMT

Hi DL,

The link below is the same as the one Craig copy/pasted. If you look at the first table, you will see the limits of authentication/ authorization rules per deployment

https://communities.cisco.com/docs/DOC-68347

-Krishnan