topic Why this feature is on the in Network Access Control

ISE 1.3 Distributed environment

Augustgood — Mon, 11 Mar 2019 05:56:22 GMT

Hi all,

in a network with two main campus and ten remote office with 3000 total device, for implement Cisco Ise 1.3 distributed, we want to buy 2 appliance SNS- 3415-K9 for management/monitoring/policy sync and 10 VM for policy sevice node, but we found that in distributed environment we need a pair of inline posture node, we must buy other two appliance or VM for inline posture ??

1.You should look through the

jan.nielsen — Mon, 27 Jul 2015 16:25:29 GMT

1.You should look through the ISE design guides, i believe that you should have MNT and PAN on different servers to support more than 5 dedicated PSN's. Having one 3415 as Primary PAN, Secondary MNT, and one as Primary MNT, Secondary PAN is only supported with up to 5 PSNs.

Distributed environment does not require inline nodes, and that functionality is also on the way out. What is the reason you think this would be required ?.Is it for a non-cisco network ?

Check this url for more information on scaling ise deployments :

http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/installation_guide/b_ise_InstallationGuide13/b_ise_InstallationGuide12_chapter_00.html#ID-1413-000000dc

Why this feature is on the

Augustgood — Mon, 27 Jul 2015 19:27:19 GMT

Why this feature is on the way out ? is not a required, but can be a customer request ?

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_ipep_deploy.html#pgfId-1265599

But the secondary MNT/PAN can manage 5 psn or work in standby ?

you are telling me that If one remote office fail, lose psn .... ?

Well, it's not been

jan.nielsen — Mon, 27 Jul 2015 19:48:36 GMT

Well, it's not been officially said by Cisco, but it's already been removed from working on the SNS.3495, so i would say it's not something that one should design new ISE solution with.

No, the secondary PAN/MNT will manage the same PSNs as the primary, you can't divide your PSNs between PAN/MNT nodes.

"you are telling me that If one remote office fail, lose psn .... ?"

Not sure what you are asking,?

ok thank you i ask you, if my

Augustgood — Tue, 28 Jul 2015 04:30:02 GMT

ok thank you

i ask you, if my PAm/mnt primary fail , my secondary can manage only the same psn of primary, not other

Yes, your primary and

jan.nielsen — Tue, 28 Jul 2015 07:25:17 GMT

Yes, your primary and secondary PAN are the same, the primary replicates it's config to the secondary, so when the primary fails, the secondary takes over (only automatically from ise 1.4), they can't manage different PSNs.

Yes

jan.nielsen — Tue, 28 Jul 2015 07:39:12 GMT

Yes