topic Re: ISE Sizing and Scalability Question in Network Access Control

ISE Sizing and Scalability Question

packet2020 — Mon, 03 Jun 2024 12:10:23 GMT

Hi All,

I'm currently working on an ISE 3.2 Medium Deployment design that will comprise of 2 x SNS 3795 appliances operating as combind PAN + MnT + pxGrid nodes and 4 x SNS 3755 appliances operating as PSN nodes.

I want to confirm the maxium scalability of this design against the following ISE Performance and Scalbility document, however I'm not sure if I'm interpretting the info correctly.

https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Based on this guide, the maxium concurrent sessions that a Medium deployment can support using the SNS 3795 as cominbed PAN + MnT + pxGrid node is 150,000. Although the 4 x SNS 3755 PSNs each support 100,000 concurrent active sessions, the maximum possible conncurrent sessions is dictated by the PAN/MnT/PxGrid deployment which is 150k in this example, is that correct?

Also for the PSNs, what is meant by "Shared PSN (Cisco ISE node has multiple Personas)"? Is this only applicable if pxGrid is also running on the PSN or does it included services such as Device Admin and SXP?

Re: ISE Sizing and Scalability Question

ahollifield — Mon, 03 Jun 2024 12:25:16 GMT

You are correct. ISE scale is limited based on the type of deployment, size of PAN/MnT, and size of the PSNs. If you need more than 150,000 you need to break out the PAN and MnT into their own nodes. Shared PSN mean combined with other roles at the "top level" checkboxes on the deployment screen. So PAN, MnT, or pxGrid; it does not apply to the various services within the PSN section.

Re: ISE Sizing and Scalability Question

packet2020 — Fri, 07 Jun 2024 09:10:04 GMT

Actually another question on this

If we need more than 150,000 concurrent sessions and break out the PAN and MnT into their own nodes as you stated, so adding two additional nodes to the deployment, what do we do with the pxGrid persona? Can pxGrid be colocated on the dedicated PAN, MnT, or PSN nodes and still be a valid deployment to still support above 150k scale, or will dedicated pxGrid nodes be required as well?

For example, will this be a valid deployment if we split out the PAN and MnT nodes and enable pxGrid on the PSNs?

PAN Primary
PAN Secondary
MnT Primary
MnT Secondary
PSN1 + pxGrid
PSN2 + pxGrid
PSN3
PSN4

Re: ISE Sizing and Scalability Question

ahollifield — Fri, 07 Jun 2024 09:54:30 GMT

No, dedicated pxGrid node is required in a large deployment.