topic Re: PXGrid and SXP Nodes in Network Access Control

PXGrid and SXP Nodes

GRANT3779 — Thu, 23 Jun 2022 10:13:49 GMT

Hi CSC,

I currently have the following Deployment of ISE (3.x)

NODE 1 - Admin(p) MnT(s)

NODE 2 - Admin(s) MnT(p)

Node 3 - PSN

Node 4 - PSN

I'm looking to add some PxGrid and SXP services to the deployment. I do have 2 x spare ISE VMs with licenses I could use. Would spinning up these 2 new VMs and running PXG / SXP on dedicated nodes be an option? Looks like it is a supported design based around the small multi-node deployment model.

If I were to instead run PxGrid on the current deployment with no new VMs is it best placed on the Admin Nodes or PSNs?
Thanks

Thanks

Re: PXGrid and SXP Nodes

balaji.bandi — Thu, 23 Jun 2022 10:34:16 GMT

as per my notes you can dedicated PXgrid if you have spare VM as below :

Re: PXGrid and SXP Nodes

Rob Ingram — Thu, 23 Jun 2022 10:50:32 GMT

@GRANT3779 what is the scale of the design, how many concurrent users/bindings etc?

Adding more roles (pxGrid and SXP) to the existing PSN nodes might cause issues, if heavily loaded.

There is no problem running pxGrid and SXP on separate pair of dedicated ISE PSN nodes.

Re: PXGrid and SXP Nodes

GRANT3779 — Thu, 23 Jun 2022 10:46:49 GMT

Thanks Balaji,

For the SXP service, is this best placed on the existing PSNs? I understand SXP needs to be on a Node which is acting as a PSN

Re: PXGrid and SXP Nodes

balaji.bandi — Thu, 23 Jun 2022 11:21:47 GMT

I suggest to run those on spare VM

Re: PXGrid and SXP Nodes

GRANT3779 — Thu, 23 Jun 2022 11:25:51 GMT

Hi Rob,

At the moment I'd say there won't ever be more than 15,000 combined of "everything". I think it is probably wise however to utilize the 2 spare nodes as going forward we will be bringing on some SDA sites also. Provide a bit more scalability.

Re: PXGrid and SXP Nodes

Rob Ingram — Thu, 23 Jun 2022 11:47:56 GMT

@GRANT3779 yes utilise the spare nodes, to future proof.

ISE scale and performance guide below shows different deployment options. With only 15k connections, that not a huge amount (depending on your ISE hardware/VM spec). https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html