topic Re: CWA maximum sizing in Network Access Control

CWA maximum sizing

Rich Yim — Tue, 17 Jan 2017 15:17:52 GMT

I have a large Guest WiFi deployment which requirements for CWA are as below:

1) 100K guests per day, and their session can last for 7 days

2) Estimated that our system to store for 1M guest information

I would like to explore whether ISE can support it.

- How to scale out the CWA for ISE? (cluster support?)

- How to sizing the ISE for the guest portal deployment?

3) Some of the area are using 3^rd party WiFi solution (Motorola)

- - Can we support 3^rd party WiFi system?

C Social media support (Facebook, WeChat, etc)

- Can we support Social Media with our ISE system?

Re: CWA maximum sizing

Jason Kunst — Tue, 17 Jan 2017 16:16:07 GMT

Have you looked into service provider EMSP?? Is ISE really the best choice? This doesn't seem like a normal corporate type of scenario? Seems like conferences venues??

ISE supports 1M guests, 1.5M endpoints. For guest users might be ok, cutting it close as you would purge after 7 days. database might start getting full. Also have to look into endpoint purging

ISE Performance & Scale

ISE Third-Party NAD Profiles and Configs

We don't currently integrate with social media, please reach out to the ISE Product Marketing team through your sales channel.

Re: CWA maximum sizing

Craig Hyps — Tue, 17 Jan 2017 22:53:55 GMT

100k guests each day, each active for 7 days, implies a rolling average of almost 5M active sessions per day. I suspect actual requirement is way less. Guest connections are typically shorter lived, even if account is usable for multiple days, or they are sporadically active across the time period that account is valid. Therefore, concurrent active sessions at one time is usually far less.

The Perf & Scale link provides info to the Cisco Live session BRKSEC-3699 which has a section on scaling services. ISE 2.1 scale to 500k concurrent active sessions. The function which must be well designed is initial web auth. Web auth rate is generally much less than 802.1X or basic MAB. Therefore, it is recommended to leverage auto-registration and/or 802.1X with Guest accounts where possible. For higher scale web auth, it is recommended to leverage multiple PSNs behind a load balancer. Also, it having more "small" appliances can scale better than fewer "large" appliances from a transaction rate perspective.

/Craig