topic How to design 3 Nodes ISE? in Network Access Control

How to design 3 Nodes ISE?

ccie14007 — Fri, 21 Feb 2020 18:49:13 GMT

We have 3 ISE nodes license, Want to use 2 in Primary DC, with HA. and then use the 3rd one in the DR.

IN Primary DC, 1 is Primary for Admin, Policy and Monitor.

2 is Secondary for Admin, Policy and Monitor

Then how to do with the 3rd one in DR?

thanks

Re: How to design 3 Nodes ISE?

Rob Ingram — Sun, 18 Mar 2018 16:53:10 GMT

Hi,
How many users/devices will it be supporting? What services - wired, wireless 802.1x? Guest portals? BYOD?.

3 is an awkward number. How about this:

1 - Primary PAN and MNT
2 - Secondary PAN and MNT + PSN
3 - PSN

this leaves the first ISE node dedicated mgmt and provides redundancy for all personas.

HTH

Re: How to design 3 Nodes ISE?

Mark Elsen — Sun, 18 Mar 2018 17:19:27 GMT

- By not using such a model , use standard deploymens; 2 admin + monitor , +2 PSN = 4!

Re: How to design 3 Nodes ISE?

ajc — Mon, 19 Mar 2018 20:32:06 GMT

My 2 cents.

-The ISE radius or tacacs servers for authentication are the ones running PSN persona not PAN/MNT (admin nodes).

-You should NOT combine multiple personas into the same appliance or VM. But if you have resources constrains then, you should ONLY have 1 primary PAN/MNT, 1 Secondary PAN/MNT and 1 PSN. But still, 1 PSN is not enough because you need redundancy for authentication.

-Running 3495 servers + 2 personas is NOT a good combination, I have seen performance issues so it is much better to run at least 3595.

-At the end, you need minimum 4 appliances or VM's.

Re: How to design 3 Nodes ISE?

Michael Bartholomæussen — Thu, 22 Mar 2018 07:14:55 GMT

I've made this topology of our new ISE deployment. I'll be happy to receive any comments or suggestions for better planning, since I've properly missed something. The PSN in the top is deployed, IF the redundant links towards the DC's i disconnected.

Re: How to design 3 Nodes ISE?

paul46 — Mon, 26 Mar 2018 00:18:40 GMT

Primary PAN+MnT and Secondary PAN+MnT with 3 x PSNs looks good

I would put all three PSNs in a nodegroup to provide redudancy

happy to receive feedback on my thoughts