topic Re: 2 Node Virtual ISE Deployment in Network Access Control

2 Node Virtual ISE Deployment

thenetadmin — Sat, 30 Nov 2024 11:58:00 GMT

Hello,

We are deploying a 2 node Cisco ISE in a virtual environment for single site/location and integrate it with DNA Center as well.

Node 1: PAN, MNT, PSN & PxGrid

Node 2: PAN, MNT, PSN & PxGrid

Any best practices to be followed for distributing personas across the two nodes?

Thank you in advance for your insights!

Re: 2 Node Virtual ISE Deployment

Torbjørn — Sun, 01 Dec 2024 07:55:28 GMT

Hello @thenetadmin,

You should see the following documentation regarding this: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/install_guide/b_ise_InstallationGuide30/b_ise_InstallationGuide30_chapter_1.html#node-types-and-personas-in-distributed-deployments

You should keep your primary PAN node and primary MNT node separate to distribute load more evenly. The PSN persona is "primary less" and should be enabled on both nodes. The PxGrid service should be enabled on both nodes, but be aware that it relies on having a functioning primary PAN node.

Re: 2 Node Virtual ISE Deployment

thenetadmin — Fri, 13 Dec 2024 14:02:32 GMT

@Torbjørn Sorry for the late reply.

With 2 node deployment, how each personas should be distributed as best practice?

Re: 2 Node Virtual ISE Deployment

Torbjørn — Fri, 13 Dec 2024 14:27:12 GMT

No problem @thenetadmin! Let's say your nodes are named A and B. Your deployment should look like this:

Administration: Should be enabled on both, but A should be primary
Montoring: Should be enabled on both, but B should be primary
Policy: Should be enabled on both
PxGrid: Should be enabled on both

Re: 2 Node Virtual ISE Deployment

thenetadmin — Fri, 13 Dec 2024 14:41:41 GMT

Thank you so much. @Torbjørn Appreciated