topic Re: Cluster ISE on premises node with a second node in Azure in Network Access Control

Cluster ISE on premises node with a second node in Azure

Yacine BS — Thu, 08 Dec 2022 07:55:33 GMT

Hello,

We have a bare metal ISE Server on premises. We have migrated many of our services over Azure cloud and since there is only one ISE node, we want to have a cluster with a node in the cloud. Is it possible and what are the limitations for this cluster?

Thanks,

Re: Cluster ISE on premises node with a second node in Azure

balaji.bandi — Thu, 08 Dec 2022 08:21:40 GMT

Most use case Cisco suggest below :

- The location of AAA clients is important. You should locate the Cisco ISE nodes as close as possible to the AAA clients to reduce network latency effects and the potential for loss of access that is caused by WAN failures.

- Latency guidance is not a “fall off the cliff” number, but a guard rail based on what QA has tested.
- Not all customers have issues with > 300ms while others may have issues with <100ms latency due to overall ISE design and deployment.
- Profiler config is primary determinant in replication requirements between PSNs and PAN which translates to latency.
- When providing guidance, max 300ms roundtrip latency is the correct response from SEs for their customers to design against.

Look at Azure deployment considerations :

https://www.cisco.com/c/en/us/td/docs/security/ise/ISE_on_Cloud/b_ISEonCloud/m_ISEonAzureServices.html

Other factors you need to check : LDAP, DNS other stuff.

Re: Cluster ISE on premises node with a second node in Azure

Yacine BS — Thu, 08 Dec 2022 09:09:41 GMT

Thank you for your response,

However, since the points to consider are not a priority for this deployment, is it possible to have an ISE cluster between a bare metal and Azure VM.

Thanks

Re: Cluster ISE on premises node with a second node in Azure

ahollifield — Thu, 08 Dec 2022 13:38:16 GMT

Sure, this is certainly possible. This is the same as combining traditional on-premise hypervisors (VM-Ware ESXi) with SNS appliances.

Re: Cluster ISE on premises node with a second node in Azure

balaji.bandi — Thu, 08 Dec 2022 13:42:59 GMT

I mean - yes possible with above consideration

Re: Cluster ISE on premises node with a second node in Azure

Yacine BS — Thu, 08 Dec 2022 22:11:36 GMT

Thank you for your help!