topic Re: Alternatives to ISE for NAC? in Network Access Control

Alternatives to ISE for NAC?

jmcgrady1 — Thu, 18 Mar 2021 07:35:57 GMT

ISE is such a big cumbersome beast. Are there any commonly used alternatives for NAC on Cisco switches and wireless?

Re: Alternatives to ISE for NAC?

balaji.bandi — Thu, 18 Mar 2021 08:07:45 GMT

Freeradius or MS NPAS

or other commercials :

https://www.itcentralstation.com/products/cisco-ise-identity-services-engine-alternatives-and-competitors

Re: Alternatives to ISE for NAC?

Mike.Cifelli — Thu, 18 Mar 2021 12:27:56 GMT

ISE is such a big cumbersome beast.

-This is because it is the best option on the market in regard to NAC. Well worth the time and investment especially if already in a Cisco centric environment.

Re: Alternatives to ISE for NAC?

Angel_Inglese — Sat, 20 Mar 2021 00:31:40 GMT

Good night from here,

Before going into ISE or ACS I had the time to test NAC solutions for security corporate reasons. I came across PacketFence as an Open Source Solution (and for education purposes).

Then configured everything with low resources, then upgraded into ISE 2.7p3. Everything started easy after we already had our network adapted for that.

hope that my opinion would work for you.

Re: Alternatives to ISE for NAC?

jmcgrady1 — Sat, 20 Mar 2021 03:35:36 GMT

I'll do some research on what a VM ISE implementation would look like when specifying "low resources". My first run through the sizing estimator told me i need a VM with 96 cpu cores!

Re: Alternatives to ISE for NAC?

Angel_Inglese — Sat, 20 Mar 2021 15:25:10 GMT

hey ! that's huge!

well please consider a lab environment first: Standalone mode VM that will serve one SSID. (8 vCPU / 8 GB RAM / 300 GB Storage)
Then grow up to PoC lab: Two HA nodes serving WiFi and cable. (2x 8 vCPU / 16 GB RAM / 300 GB Storage)

I read the community post regarding ISE deployments.

And took the risk with low impact considerations.

Started with specific groups such as Guests for HQ then remote offices, one by one (only 10 sites).

https://community.cisco.com/t5/security-documents/cisco-ise-amp-nac-resources/ta-p/3621621

of course, this was a lapse time of 3 months (the demo license period). and after this we decided to move on with ISE 2x SNS 3615 HA mode with Mnt node over VMWare for log storage in a SAN.

hope that helps,

Re: Alternatives to ISE for NAC?

balaji.bandi — Sat, 20 Mar 2021 15:51:08 GMT

you can start with 32GB with less CPU