Load Balancer Design Clarifications

Patrick Lloyd — Fri, 19 Mar 2021 20:41:11 GMT

Hi Folks,

In each our design guides relating to Load Balancer placement and design, the official stance is that load balancers must be placed either logically or physically in line with PSN's, with the PSN acting as the gateway to the PSN's. Is this a hard requirement, or is this just the recommended and tested requirement for implementation of load balancers? Has placing the load balancer on a shared segment with a router and using the router to differentiate which traffic at Layer 3 is required to go to the load balancer been considered or tested at all? Are there other non-in-line designs that have been tested at all?

References:

https://community.cisco.com/t5/security-documents/how-to-cisco-amp-f5-deployment-guide-ise-load-balancing-using/ta-p/3631159

https://community.cisco.com/t5/security-documents/citrix-netscaler-1000v-load-balancing-config-for-ise/ta-p/3634374

https://www.ciscolive.com/global/on-demand-library.html?search=ise%20scale%20high%20availability#/session/1511296160606001Af1J

Thanks!

Re: Load Balancer Design Clarifications

hslai — Sun, 21 Mar 2021 19:52:59 GMT

How To: Cisco & F5 Deployment Guide: ISE Load Balancing Using BIG-IP > About This Document says,

...

Many features may exist that could benefit your deployment, but if they are not part of the tested solution they may not be included in this document. Other configurations are possible and may be working successfully in your specific deployment, but may not be covered in this guide due to insufficient testing or confidence for a stable deployment. ...

The Citrix NetScaler configuration was contributed by a Cisco engineer in Cisco services teams.

Regarding one-arm, see Craig's response in ISE behind load balancer

topic Load Balancer Design Clarifications in Network Access Control

Load Balancer Design Clarifications

Re: Load Balancer Design Clarifications