topic Re: Multiple ISE clusters in Cisco DNA-C in Software-Defined Access (SD-Access)

Multiple ISE clusters in Cisco DNA-C

Dominic Stalder (old profile) — Sun, 29 Sep 2019 15:22:36 GMT

Dear community

we are running a Cisco DNA-C v1.3.1 and as far as I understand the data sheet for this version, it should support multiple, different Cisco ISE clusters:

https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/dna-center/nb-06-dna-center-data-sheet-cte-en.html#NewfeaturesforCiscoDNACenter1310

if I try to add a second Cisco ISE instance (say another Primary & Secondary deployment), the slider for „Cisco ISE“ is greyed out.

Does anybody have a SDA deployment with multiple Cisco ISE in use or I am wrong with my understanding?

Thanks and best regards

Dominic

Re: Multiple ISE clusters in Cisco DNA-C

faylee — Fri, 18 Oct 2019 00:53:50 GMT

Hi Dominic,

We need to get the data sheet corrected. Multi-ISE to single DNAC is not yet supported.

Apologies for the confusion,

Fay-Ann

Re: Multiple ISE clusters in Cisco DNA-C

Dominic Stalder (old profile) — Fri, 18 Oct 2019 05:06:33 GMT

Thanks for the clarification, Fay-Ann

Re: Multiple ISE clusters in Cisco DNA-C

AdelIazzag-AiTech — Wed, 27 Oct 2021 14:45:57 GMT

Hello,

Do you know when this will be supported ? Is there anyway to use multiple ISE deployments with 1 DNA yet ?

Re: Multiple ISE clusters in Cisco DNA-C

Isaac Bode — Wed, 06 Sep 2023 13:49:45 GMT

Is this supported yet? We have 2 separate ISE clusters, 1 for test and 1 for production. I need to be able to use all of them within DNA Center. Can I use a virtual IP and put all 4 psn nodes from both systems behind the IP and use that in DNA Center?

Re: Multiple ISE clusters in Cisco DNA-C

Andrii Oliinyk — Wed, 06 Sep 2023 14:29:43 GMT

let's separate meat from flies:
1) with DNAC-ISE integration your only option is to use primary PAN
2) with just AAA u can use PSNs from different ISE-cubes, but i believe u would like to stay with separated AAA for test & prod environment. Other words if u have f.e. prod ISE-cube w/ 4 PSNs u may design one site to use 1st 2 of them & for other site to use remaining 2. no issues under accurate considerations. but mixing for the same site PSNs from prod & test ISE-cubes would be the least i would try to attempt (may be only in total blackout)

Re: Multiple ISE clusters in Cisco DNA-C

Isaac Bode — Wed, 06 Sep 2023 14:51:54 GMT

Ok, so as I understand it.

1. Add Prod ISE as type "ISE" in DNAC. This will allow for PXGRID integration.

2. Add Test ISE as type "AAA" in DNAC. This will allow all nodes to be used for the sites I want to assign them to.

Does DNAC allow for using more than 2 AAA servers when designing policy? I have some instances where we have more than 2 PSN's in rollover fashion for failover redundancies.

Re: Multiple ISE clusters in Cisco DNA-C

Andrii Oliinyk — Wed, 06 Sep 2023 15:29:07 GMT

1. Yes. when u will configure it u'll have n option to also configure VIPs for such a functions like RADIUS AAA or TACACS admin-access. After integration all this stuff including real IPs of PSNs of the integrated cube will be available for u to chose in Network Design.
2. This is not how i'd do. Instead i'd create network template with group of test PSNs & aaa commands to use groups etc radius/tacacs relevant commands. & then i'd deploy it to switches per need. Obviously test ISE would be fully unaware of prod DNAC (remeber u may integrate with DNAC only one ISE-cube)