topic ISE PX-Grid in Network Access Control

ISE PX-Grid

DAVID — Mon, 23 Mar 2020 00:03:11 GMT

It is a best practice to configure an ISE PX-GRID as a stand-alone on an existing deployment or as another secondary? This also applies to an ISE 2.6 that I wish to dedicate as PSN for device administration (TACACS). I currently have two 3615's running ISE 2.6 patch 5 running as primary/secondary. I have 2 3515's running ISE 2.6 patch 5 that I would like to incorporate PX-GRID and DEVICE Admin

Re: ISE PX-Grid

Damien Miller — Mon, 23 Mar 2020 00:27:24 GMT

In a standalone deployment (one or two nodes hosting everything) such as you have where all services are hosted in HA across each other, you are fine to run pxgrid and device admin on them as well. This is a supported and tested deployment model.

With that in mind, the scaling numbers are much lower when shared with the PAN/MNT/PSN. In this case, 3600 series appliances don't have published pxgrid scaling numbers, but as of 2.4 and 3500's we had the following guidance.

3515's - 20 pxgv2 subscribers, but only 2 pxgv1

3595's - 30 pxgv2 subscribers, again only 2 pxgv1

Published here for the 3500's and 2.4, and the BU is aware that they need some updates on this guide. In the mean time we can safely assume you can support 20 version 2 subscribers.
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--2097652494

Re: ISE PX-Grid

DAVID — Mon, 23 Mar 2020 01:21:48 GMT

Re: ISE PX-Grid

Damien Miller — Mon, 23 Mar 2020 01:01:46 GMT

The images you attempted to share did not appear, I would also recommend editing out your contact info since this is a public and google indexed forum.