topic Re: Profile Sizing of a ISE PSN in Network Access Control

Profile Sizing of a ISE PSN

danielbarri — Fri, 28 Oct 2022 10:29:28 GMT

On An ISE multi-node fully distributed deployment, in a customer environment with multiple sites (more than 10) and endpoints not exceeding 2K in each site; deploying a dedicated PSN(VM appliances) on each site that will take care of sessions for that particular site.

If I understood correctly what is stated in the documentation:

http://cs.co//ise-scale

A PSN, as described above, can be a Small sized one; am I right?

Does the number of PSNs(e.g. 15 PSNs), in a aforementioned deployment, tell that we are talking about a large deployment? Or at the end, is it the number of concurrent endpoints that will tell what will be the PSN profile size?

Re: Profile Sizing of a ISE PSN

Rob Ingram — Fri, 28 Oct 2022 10:51:29 GMT

@danielbarri yes, with 15 PSN it would considered a large deployment, but is a PSN per site excessive? You could have a couple of larger PSNs centrally (with the PAN/MnT nodes), this would be cheaper and provide fully resilency.

Re: Profile Sizing of a ISE PSN

danielbarri — Fri, 28 Oct 2022 11:41:39 GMT

OK, 15 PSN --> Large deployment.

Does it mean that all 15 PSNs should also be of Large profile size? despite of (some of them) are taking care of only up to 2K endpoints? Or is it possible to have PSNs with Small profile size among them?

Is there only possible, some kind of one to one relation, between deployment size and PSN profile size? i.e.

Small Deployment -- > Small sized PSN

Medium Deployment --> Medium sized PSNs

Large Deployment --> Large sized PSN

Re: Profile Sizing of a ISE PSN

Rob Ingram — Fri, 28 Oct 2022 12:07:14 GMT

@danielbarri a large deployment is 7 or more PSN nodes.

You can have a large deployment with PSN profile size of small, medium or large. However a large deployment does not support small PAN/MNT profiles.