topic Re: How many maximum mac address can create in endpoint identity ? in Network Access Control

How many maximum mac address can create in endpoint identity ?

jewfcb001 — Wed, 31 May 2023 06:47:47 GMT

Hi All ,
I try to find information about Maximum Mac Address can create in endpoint identity on Cisco ISE 2.7 or 3.x
My deployment is 2 Cisco ISE HA (Admin+PSN+Monitor) Primary and Secondary .

I see link below but not found the exact maximum number of mac address can create in endpoint identity.

https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Please advise me .

Re: How many maximum mac address can create in endpoint identity ?

jewfcb001 — Thu, 01 Jun 2023 04:58:36 GMT

I still waiting someone to help.

Re: How many maximum mac address can create in endpoint identity ?

Greg Gibbs — Thu, 01 Jun 2023 22:46:32 GMT

I don't believe there is a theoretical maximum for the number of MAC addresses that can be stored in the endpoint database, but the maximum validated is 2 million.

With your 2 node cluster, the number you would need to be concerned about would be the supported concurrent sessions based on the platform specs you are using (which you have not mentioned).

Re: How many maximum mac address can create in endpoint identity ?

jewfcb001 — Fri, 02 Jun 2023 02:57:28 GMT

@Greg Gibbs

Thank you for information. I deploy VM Small Type If reference from concurrent sessions VM Small type support 10000 concurrent . Can I use this value for mac address (endpoint ) store in database ?

Re: How many maximum mac address can create in endpoint identity ?

Damien Miller — Fri, 02 Jun 2023 03:12:07 GMT

Yes, you can store 2 million mac address entries in the context visibility database.

A small VM will support up to 10,000 unique endpoint/macs being online and active on the network at any given point in time. This number is up to 10,000 though, there are many variables that can impact this like rate of auth, auth type, etc.

I've had customers exceed the 2 million total macs, one just under 5 million without issue. The scale for this used to be stated as 2 million, for some reason that specific scale number is no longer reported.

Re: How many maximum mac address can create in endpoint identity ?

jewfcb001 — Fri, 02 Jun 2023 03:26:35 GMT

@Damien Miller
Can you provide official document to me ? or Can I refer from concurrent session? Because If a small VM support 10k concurrent but we add mac address greater than 10k ISE still handle 10K current also. Please advise me.

Re: How many maximum mac address can create in endpoint identity ?

Damien Miller — Mon, 05 Jun 2023 19:44:50 GMT

The concurrent sessions are well documented on the performance and scale page.
https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

The total known endpoints has turned in to tribal knowledge, there used to be stated scale in the performance and scale guide but the number is no longer published. You can look at the 2.6+ endpoint scale on an archive of this old scale document. Search for "maximum endpoints" in this table and you will find the 2 million number on the far right column. This was increased from 1.5 million that 2.4 or older supported.
https://web.archive.org/web/20210710140104mp_/https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--1312516075

Re: How many maximum mac address can create in endpoint identity ?

jewfcb001 — Tue, 06 Jun 2023 05:03:28 GMT

@Damien Miller

Thank you so much for information .