topic Re: ISE inside ACI Fabric in Network Access Control

ISE inside ACI Fabric

packet2020 — Sat, 28 Jan 2023 00:07:14 GMT

We are planning the install of a new ISE 3.1 deployment and I have been asked to evaluate the pros and cons of installing the required SNS-3695 appliances within our data centre and physically connecting to our ACI fabric production tenant.

I have reviewed and I cant see anything technically wrong with connecting ISE physically to ACI unless there are considerations that we need to make if we plan to implement TrustSec and ACI integration. This is not something that we plan to in the near future, but I dont want to back ourselves into a corner if we decide to implement this at a later date. Has anyone deployed ISE within ACI before and are there any gotchas that we need to be aware of?

Re: ISE inside ACI Fabric

Arne Bier — Sun, 29 Jan 2023 23:51:33 GMT

I don't believe there is anything special or unique about ISE and ACI. I am not an ACI expert, but from ACI's point of view, ISE is just a simple server. There is an application network traffic layer (e.g. gig0 on ISE for SSH/HTTPS/RADIUS/TACACS etc.) and then also the CIMC on the SNS out of band server management traffic (you'd probably host the CIMC traffic on a separate VLAN - but it's not mandatory).

Re: ISE inside ACI Fabric

ahollifield — Mon, 30 Jan 2023 12:44:56 GMT

Yup nothing special here. ACI thinks ISE is just a normal server. ISE thinks ACI is just a normal switch.