topic Re: API scalability in Network Access Control

API scalability

martucci — Mon, 28 Aug 2017 19:57:59 GMT

I have a customer that is looking to populate NAD via API (mainly to keep in sync 2 standalone and independent deployments).

What would be the scalability of the API? They have about 2000 devices, and looking to possibly have an API syncup once a day.

I think it should be ok, but I just wanted to check before giving an answer.

Re: API scalability

hslai — Tue, 29 Aug 2017 00:42:13 GMT

I am looking into this. It seems ERS for NAD not yet tested for performance. Also, my NADs created by ERS in ISE 2.3 have odd IDs.

Re: API scalability

hslai — Tue, 29 Aug 2017 04:27:15 GMT

It turns out that ERS-created NADs will have proper-looking IDs if id is not specified in the POST/PUT data. I will check with DE on this further.

Using an internal script, my standalone ISE 2.3 in the lab is able to complete updating 500 NADs in 3 minutes, where 500 is the max bulk size.

Please note an known issue in bulk delete via ERS API for NADs.

Re: API scalability

Craig Hyps — Tue, 29 Aug 2017 17:06:56 GMT

We don't perform perf and scale testing for every possible API. For most API transactions related to internal users, endpoints, and guests, the rate is around 25/sec. To keep two deployments in sync, assume you will need to do a retrieval followed by create/update/delete operation.

There are Bulk Monitor and Bulk Request operations available for Network Devices, so extrapolating results for guests/endpoints, you may realize a 3-4 increase in scale. Again, I do not have specific results for NADs, so your mileage may vary.

/Craig

Re: API scalability

martucci — Wed, 30 Aug 2017 08:11:54 GMT

Thanks,

I just wanted to have a rough idea in case we had some general guidelines