topic Cisco ISE Distributed Deployment Node Communication in Network Access Control

Cisco ISE Distributed Deployment Node Communication

Kevin Raditheo — Tue, 06 Jun 2017 08:05:39 GMT

Hi All,

I want to ask some questions,

Currently I plan to implement Cisco ISE in Dispersed Network Deployment on 5 different countries.

The main campus will have 1 Admin Node, 1 Monitoring Node, and 2 PSN. Four other country will have 1 PSN.

My questions are:

Apart from when the nodes join, when will the PSN and Admin Node communicate each other?
When will PSN and Monitoring Node communicate each other?
When will Admin Node and Monitoring Node communicate each other?
What will it based on? Trigger by certain event such as user connection/disconnection, configuration change or will it be trigger on regular basis, ex: per 5 minutes.
Any reference about the size of information exchange between these nodes?

Thanks for any advice in advanced.

Regards,

Kevin

Re: Cisco ISE Distributed Deployment Node Communication

Timothy Abbott — Tue, 06 Jun 2017 18:16:28 GMT

Kevin,

There are several instances in which each node will talk to each other but here are some cases at a high level:

PSN -> Admin:
- Node joins deployment
- Policy created / modified on Admin
- Guest accounts created
- Device profile
PSN -> MnT
- Client connect / disconnect
- PSN health data
- Audit information
- Logging information
- Much more...
Admin -> MnT
- Session directory access (live log)
- Deployment health status
- All reporting operations
- Backup operations
- Much more...

Once the nodes are in sync, the size of information transferred in not enormous. What you need to be more concerned with is latency between nodes. Depending on the version, that could be as much as 300ms. Please see the content we have available in the community for more information about distributed deployments.

Regards,

-Tim