topic Cluster ISE in Network Access Control

Cluster ISE

Flavio Miranda — Mon, 11 Mar 2019 04:48:40 GMT

Hi guys,

I am about to deploy a Cluster of two ISE and I am in doubt with Replication. I have seen in documentation that is it necessary an physical connection between two ISEs exclusively for Replication. Therefore, it is not clear to me how to perform that. I mean, with this special connection, we must use 4 interfaces and is it necessary that Addressing stay in the same subnet? During the software instalation, is there a step where I need to point to which interfaces is gonna be used as Replication ?

thanks in advanced!

Hello-I would be interested

nspasov — Fri, 20 Jun 2014 07:21:47 GMT

Hello-

I would be interested to see the documentation that is advising on a direct link between the ISE nodes. 🙂 That is completely incorrect. The ISE nodes can either be layer 2 or even layer 3 adjacent and still be part of the same deployment/cluster. The nodes must be layer 2 adjacent if you want to place them in a "Node Group" and behind a load balancer. Otherwise what is more important is the bandwidth availability and the round trip delay between the nodes. I believe the currently supported, maximum round trip delay is 150ms.

Hope this helps!

Thank you for rating helpful posts!

Hi Neno, I may

Flavio Miranda — Fri, 20 Jun 2014 11:27:07 GMT

Hi Neno,

I may misunderstading Cisco documentation related to ISE deployment.

http://www.cisco.com/c/en/us/td/docs/security/ise/1-1-1/installation_guide/ise_install_guide.html

In this Guide, we can see a connection between nodes. I thought this is a physical connection.

Thanks for the clarification.

So, you can have a direct

nspasov — Fri, 20 Jun 2014 14:12:22 GMT

So, you can have a direct connection when running iPEP nodes (Inline Posture Nodes) which is done for redundancy and not for replication. However, my guess is that you were not talking about iPEP but just standard ISE nodes.