topic Re: ISE Nodes Deployment Question in Network Access Control

ISE Nodes Deployment Question

Tim Glen — Fri, 21 Feb 2020 18:47:57 GMT

Hi All,

I have two sites. Corp and Remote.

Corp has about 500 wired users & 50 wired printers copiers.

Corp has about 1000 wireless users devices. At Corp, I will configure ISE for wireless, wired & VPN profiling, and wireless self-registration portal.

Corp has an ASA that has SSL VPN configured. ISE will authenticate via RADIUS the Remote Access VPN Clients. About 30 authentications per hour.

Corp has about 100 Cisco devices. ISE will be the TACACS server that authenticates \ authorizes admin logins, about 20 per day.

Remote has about 50 wired users \ devices and no wireless.

Remote has an ASA that has SSL VPN configured. ISE will authenticate via RADIUS the Remote Access VPN Clients. About 100 authentications per day.

I’m planning on a distributed deployment this way.

Corp – 2 Nodes

Node 1 will be Primary Admin & Policy Service

Node 2 will be Primary Monitoring & Policy Service

Remote – 1 Node

Node 1 will be Secondary Admin, Secondary Monitoring & Policy Service

The Network Deployments in Cisco ISE recommends Monitoring and Policy Service not be on the same node so I’m concerned about this setup at the Remote site, even though the policy service will not be too busy.

Is this deployment model suggested? If you would do it differently please say so and state why.

Thank you all very much!

Re: ISE Nodes Deployment Question

Rob Ingram — Thu, 08 Mar 2018 16:34:29 GMT

Hi,

You don't have a large deployment and I don't believe you should have a problem running PAN + MnT + PSN roles on 1 node in Corp and then the same again in Remote, or just implement what you've suggested, that should be fine depending on the ISE node resources (hardware or VM) in use.

Check out this ISE scaling/performance webpage https://communities.cisco.com/docs/DOC-68347 it has good information, it indicates the maximums for each model of ISE model, you should be within the limits of even the older hardware models.

Re: ISE Nodes Deployment Question

ajc — Thu, 08 Mar 2018 16:41:09 GMT

1.-Do not use 3495 running multiple personas no matter you do not have much traffic. I have seen operational issues.

2.-Looks like you can combine multiple personas on the same node based on the number of transactions you have even though you would also integrate TACACS and RADIUS on the same ISE. Take a look on the following tables.

3.-I would suggest you to use ISE 2.3 instead of 2.2.

Re: ISE Nodes Deployment Question

Tim Glen — Thu, 08 Mar 2018 18:29:05 GMT

Thank you both for your tips.

I won’t be using the 3495 at all. All of my ISE VM’s will be based off the 3595 OVA. All will be thick provisioned as well. I will be using ISE 2.3.