topic Re: PAN/Mnt/PXGrid and PSN virtual deployment in Network Access Control

PAN/Mnt/PXGrid and PSN virtual deployment

ibrahimbadr4669 — Wed, 30 Aug 2023 17:21:04 GMT

Dears,

I have two nodes (PAN/Mnt/PXGrid and PSN ), I have to choose which one will be on appliance 3615 and which one will be on virtual deployment?

1- PSN virtual and PAN/Mnt/PXGrid on the appliance

2- PSN on appliance and PAN/Mnt/PXGrid virtual

Thanks and BR;

Re: PAN/Mnt/PXGrid and PSN virtual deployment

balaji.bandi — Wed, 30 Aug 2023 13:45:11 GMT

i go with the below :

2- PSN on appliance and PAN/Mnt/PXGrid virtual

also make sure you choose right VM compute resources.

Re: PAN/Mnt/PXGrid and PSN virtual deployment

ibrahimbadr4669 — Wed, 30 Aug 2023 13:47:00 GMT

Thanks alot Balaji for your kind support, is there cisco document discuss this subject

Re: PAN/Mnt/PXGrid and PSN virtual deployment

Greg Gibbs — Wed, 30 Aug 2023 22:14:00 GMT

Duplicate post. See https://community.cisco.com/t5/network-access-control/pan-mnt-pxgrid-and-psn-virtual-deployment/td-p/4914630

Re: PAN/Mnt/PXGrid and PSN virtual deployment

ibrahimbadr4669 — Thu, 31 Aug 2023 06:11:50 GMT

Re: PAN/Mnt/PXGrid and PSN virtual deployment

ibrahimbadr4669 — Thu, 31 Aug 2023 07:22:36 GMT

if we use virtual for PSN, if the it's fail. I Think it's easier to recover it . Is the virtual has performance issue so HW is preferred as PSN do the main function of ISE. Is that Right ?

Re: PAN/Mnt/PXGrid and PSN virtual deployment

hslai — Fri, 01 Sep 2023 04:54:28 GMT

@ibrahimbadr4669 If you have two ISE nodes, it's better to have both to run everything for redundancy. Virtual appliances could perform better or poorer than hardware appliances depending on the underlying hardware and resource allocations.

Re: PAN/Mnt/PXGrid and PSN virtual deployment

ibrahimbadr4669 — Fri, 01 Sep 2023 08:50:48 GMT

@hslai thanks for your reply, we will do the medium deployment and the redundancy is considered, however due to the appliance numbers limitation we have , we will mix virtual and appliance. So my question if I have to choose between PSN and PAN/Mnt/PXGrid which one should be virtual ? And if there is any document that discuss the pros and cons , it will be wonderful

Re: PAN/Mnt/PXGrid and PSN virtual deployment

hslai — Fri, 01 Sep 2023 21:55:58 GMT

@ibrahimbadr4669 If your access to both virtual and hardware appliances are the same and the both types have the same performance characteristics, then it does not matter how you assign the personas. You may always swap the personas around later.

Re: PAN/Mnt/PXGrid and PSN virtual deployment

balaji.bandi — Fri, 01 Sep 2023 23:52:33 GMT

some of the things not documented always it was experience we suggest.

to be honest if you do not do compute properly on Virtual environment ISE struggle lot - compare to appliance which was tuned for ISE to run as expected.

Re: PAN/Mnt/PXGrid and PSN virtual deployment

hslai — Sun, 03 Sep 2023 01:43:57 GMT

Virtual should be more flexible and, with properly reservation, have similar performance characteristics to that of HW. You might want to opt for HW due to coordination complexity with virtual infrastructure teams, and due to security.

Re: PAN/Mnt/PXGrid and PSN virtual deployment

ibrahimbadr4669 — Sun, 03 Sep 2023 09:53:39 GMT

thanks you all a lot for your kind information and support