topic Re: ISE 2.4 Resizing in Network Access Control

ISE 2.4 Resizing

zhilimailbox — Fri, 11 Sep 2020 01:11:17 GMT

Hi,

Our ISE 2.4 nodes take up lots of resources from the original OVA file deployment. We would like to resize it based on the usage in vmware. Would there be any issues? Any suggestions if we do resizing?

Re: ISE 2.4 Resizing

Greg Gibbs — Fri, 11 Sep 2020 02:15:51 GMT

See a similar question on this post. You can add CPU/Memory to the VM, but you cannot resize the HDD without rebuilding the node.

Also, ISE determines the 'hardware' model by the CPU/Memory specs and uses the least common denominator. If you increase them, make sure they match the intended hardware model as defined in the ISE Performance & Scale document.

You can confirm the platform type as per this CiscoLive slide:

Re: ISE 2.4 Resizing

zhilimailbox — Fri, 11 Sep 2020 02:54:41 GMT

Thanks for the reply!

the two PAN (Medium/3595) VM nodes have 16 CPU + 64G MEM, while the two PSN (Small/3515) VM nodes have 12 CPU+16G MEM.

Look at the performace of the VMs, CPU usage (average 3%, range [1-10]%), MEM usage (average 7%, range [1-18]%) . With current usage, if we half the CPU and MEM, would cause any issues and what is the best way to reduce resources.

Kind regards,

Re: ISE 2.4 Resizing

Greg Gibbs — Fri, 11 Sep 2020 05:11:20 GMT

There is no calculator for that type of reduction of resources and the developers only test against the specified hardware platform specs. The CPU/Mem resources must match those hardware platforms (including the Reservations as defined in the Install Guide) and the platform deployment model should be based upon the concurrent sessions required for your environment.

As per the Release Notes, ISE 2.4 supports only the 35xx series and above. If your were to reduce the CPU/Mem to match the 34xx series appliances, for example, that ISE cluster would NOT be supported by TAC.

Also, be aware that the 'Cores per processor' numbers in the Scaling document consider that Hyperthreading is enabled on the hardware appliances. You need to ensure that either Hyperthreading is enabled for the VMs, or you double the number of vCPUs. This is why you see the 12x (3515) and 16x (3595) vCPUs deployed by the OVA.

Re: ISE 2.4 Resizing

zhilimailbox — Fri, 11 Sep 2020 07:34:45 GMT

Thanks, Greg!

The ESXi host does have hyperthreading enabled. If we go with half of the CPU allocation, that is 6x (3515) and 8x (3595), should the ISE VM nodes be running ok?

Re: ISE 2.4 Resizing

Greg Gibbs — Sat, 12 Sep 2020 03:43:21 GMT

No. That would not be supported for a production environment and would very likely lead to an unstable system.