topic Re: Cisco ISE, AAA server group in Network Access Control

Cisco ISE, AAA server group

bigbobmcquade — Mon, 15 Jun 2020 11:39:56 GMT

Hi there,

We are deploying an ISE distributed Solution without using of a dedicated load balancer.

In relation to the definition of the AAA server group, I have 4 PSNs spread evenly across 2 datacentres that i want to use. Is it best practice to define all 4 of these PSNs within the AAA server group or to only use a subset?

Thanks in advance.

Re: Cisco ISE, AAA server group

Anurag Sharma — Mon, 15 Jun 2020 12:01:40 GMT

Hi @bigbobmcquade

It really depends on how you want it. Having said that, let's say that I have 4 DC sites, with each DC containing 50 switches.

I would put a PSN in each of those 4 sites and order them based on the proximity. Meaning, DC1 would have the local PSN listed on top in the aaa group. Then, the second farther one and then the next. etc. Similarly DC2 would have its own local PSN listed first, and then the other PSNs based on Geographical or response-time prioritised PSNs.

Again, if you have a Primary-site / DR-site site system, you may choose to design it differently.

Re: Cisco ISE, AAA server group

Mike.Cifelli — Mon, 15 Jun 2020 13:19:01 GMT

To add to @Anurag Sharma comments. I like the PSN at each site sitting at the top of the list idea. However, I definitely think it depends on your requirements. If you choose to place all 4 in one group know that the priority is identified in a top-down approach. Meaning if PSN1 is first in the group then your NADs will attempt to use it first. HTH!

Re: Cisco ISE, AAA server group

bigbobmcquade — Tue, 16 Jun 2020 09:26:10 GMT

Thank you both for the advice, clear now on what we require.

Appreciate it 🙂