topic Re: What is the best way to design Cisco ISE roles in Network Access Control

What is the best way to design Cisco ISE roles

nastiakhon — Fri, 30 Jan 2026 10:32:35 GMT

Hello. Could you please tell me how to do this better?

What is the best way to design Cisco ISE roles: keep Primary/Secondary PAN and MnT separated “crosswise” on different management nodes or combine Primary PAN and Primary MnT on a single node from an HA and best practices perspective?

Re: What is the best way to design Cisco ISE roles

Rob Ingram — Fri, 30 Jan 2026 10:36:24 GMT

@nastiakhon it all depends on the environment, number of concurrent connections, features, redundancy etc. At a minimum you should have two nodes, with redundant personas (PAN, MnT, PSN) - refer to the performance and scale guide https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

Re: What is the best way to design Cisco ISE roles

nastiakhon — Fri, 30 Jan 2026 11:16:49 GMT

Yes, I read this article, but I still can't make the right decision.
Attached is a screenshot of my deployed environment.

Re: What is the best way to design Cisco ISE roles

nastiakhon — Fri, 30 Jan 2026 11:36:07 GMT

I'll add that we have an automatic fileover configured for pan nodes.

Re: What is the best way to design Cisco ISE roles

Rob Ingram — Fri, 30 Jan 2026 11:43:03 GMT

@nastiakhon looks like you've configured the ISE cluster as a medium sized, with PAN and MnT roles on the same hardware, that will suffice for cluster size up to 150K active sessions (depending on VM/hardware resources). So if you do not have a larger deploy that will be fine.

If you were designing a very large ISE cluster, you'd have to configured PAN and MnT personas on different nodes to support the scalability.

Re: What is the best way to design Cisco ISE roles

Cristian Matei — Fri, 30 Jan 2026 20:13:26 GMT

Hi,

@nastiakhon Using separate boxes for PAN & MNT roles should be done only when necessary, if scale requires it, otherwise its add complication with no benefits. Take a look at this document and make your decision based on scaling numbers, MEDIUM means PAN & MNT roles on same box, while LARGE means PAN & MNT roles on separate boxes:

https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2025/pdf/BRKSEC-3234.pdf

Thanks,

Cristian.

Re: What is the best way to design Cisco ISE roles

Ambuj M — Sat, 31 Jan 2026 05:37:49 GMT

what you have is not bad, you should look at it not just from node persona distribution point of view but more holistically.

There are some great presentations in Cisco live on demand library, just search for "Cisco ISE Best Practices"