topic Re: Basic 2-node deployment in Network Access Control

Basic 2-node deployment

Hung_lin — Fri, 04 Dec 2020 10:59:15 GMT

Hello All

The current demand for Sessions requires a total of 50,000

My device is Model for SNS 3600, a total of two
Buy a license for 25000 Sessions
I set up the two deployments, can it reach Sessions 50000

Re: Basic 2-node deployment

Damien Miller — Fri, 04 Dec 2020 15:05:44 GMT

If you happen to have 2x SNS-3695 appliances, then you could run a 2 node HA deployment that supports 50k active endpoints. In this scenario you would have to have the SNS-3695 256 GB nodes, and you would have to order another 25k endpoint licenses.

Or you can run two separate single node deployments with no HA. Again, you would still need to order another 25k endpoint licenses.
Deployment 1: 1x 3655 = 25k active sessions

Deployment 2: 1x 3655 = 25k active sessions

Since you only have 25k endpoint licenses, you will run in to licensing issues in both scenarios unless you order additional.

Re: Basic 2-node deployment

ezxw78128 — Tue, 08 Dec 2020 02:03:08 GMT

Hi sir,

So, if I integrate the SLB device to divide the authentication session per unit (PSN) not more than 25,000, then two sns-3655 deployments (HA) cannot support a total of 50,000?

Re: Basic 2-node deployment

Damien Miller — Tue, 08 Dec 2020 04:16:08 GMT

If you were to keep the two nodes independent and not join the two ISE nodes together, they could each support 25k. Together as a high availability pair, they only support 25k active sessions.

In this scenario, configuration would have to be done on both admin nodes separately, logging would be independent on each node, and if a node were to fail, you do not have a secondary to act as a backup from a configuration standpoint. They would not know about each other. The network devices (switch/wlc etc) would be configured with the two separate ise "deployments", where each deployment was a single node.