topic ISE Deployment Questions in Network Access Control

ISE Deployment Questions

Craddockc — Wed, 13 May 2020 20:06:07 GMT

Dear Community,

My team has been tasked with getting ISE deployed from scratch and I had a few questions about the how we should design the deployment. We have roughly 1200 retail locations throughout the United States with between 10k - 15k employees nationwide. Here are my questions:

1) Given the size of the company, how big if a distributed design should we do? Should we do dedicated Admin/Monitoring/Policy nodes? Or can we combine the Admin nodes with a Policy node? I was reading that you shouldn't combine the monitoring node with any other node. Is this best practice?

2) We will be running ISE VM's in VMWare. What is the difference between the OVA "Sizes" (small, medium, large)? What size OVA is recommended for each persona?

3) How much CPU, Memory and Storage should we allocate for each VM? The installation guide offers few details on how to size each VM other than mimicking a certain SNS appliance. Is it based on persona? How do we know which SNS appliance to use as a template?

I really appreciate any feedback you can provide.

Thank you.

Re: ISE Deployment Questions

balaji.bandi — Wed, 13 May 2020 20:17:41 GMT

there is a good post already available, here for refeence :

https://community.cisco.com/t5/security-documents/ise-planning-amp-pre-deployment-checklists/ta-p/3622635

other good resources to start with :

https://community.cisco.com/t5/security-documents/ise-amp-nac-community-resources/ta-p/3621621#Planning

Re: ISE Deployment Questions

Damien Miller — Wed, 13 May 2020 21:22:04 GMT

You could deploy 2x medium ISE 3655 templates to support all functions of that deployment at a high level. We refer to this as a standalone deployment where all required roles, admin, monitor, and policy service, are hosted on the same one or two nodes, preferably two for HA. These VMs would be 96 GB memory reservations, 24,000 MHz of CPU, and at least 1200 GB each. The resources for ISE VM's mirror the SNS-36x5 appliances that are available.

Two medium 3655 VM's hosting all your roles can support up to 25,000 active endpoints in full HA.

Re: ISE Deployment Questions

Craddockc — Thu, 14 May 2020 12:53:27 GMT

Thank you both for the great information! I really appreciate it! It really helps to point me in the right direction.