Cisco ISE distributed deployment

[Debabrata Majhi]

Hi

We have two ISE in different subnet and location.Can we make it as single cluster?

Is it certificate mandatory ?

What are the prequation needs to be taken care?

Can any one help me 

Debu

[Surendra · Accepted solution]

Answer to your first question, Yes, you can have two ISE nodes in different subnets and locations as long as you allow the ports mentioned here between the nodes https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_0110.html

Answer to your second question, Yes, certificates are mandatory as the registration happens over secure HTTP tunnel.

For the third question,
Recommend you to follow this https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_011.pdf

[Debabrata Majhi]

Hi Surendra

Thanks for your prompt response.

Apricate your help

Hi Surendra

Thanks for your prompt response.

Appreciate your help. Just to understand

If there is any existing ISE cluster already running, can we move one node from existing ISE cluster for new location, is it possible?

Is there any licensing issue ? If I change the IP address

If possible What Shall we do

1. Unregister the server from existing cluster
2. Change the ISE IP according to new location
3. Again join the node in cluster

Am I right? Or please guide me proper steps

Thanks

[Surendra]

You can do that as long as you have connectivity. No additional licenses are required.

[Debabrata Majhi]

Hi Surendra

Thanks

In that case ,I have to follow the following steps right?

1. Unregister the Node from existing cluster
2. Change the ISE IP according to new location
3. Again join the node in cluster

Thanks

[Debabrata Majhi]

Hello Surenda

Is there any Delay which needs to be match ,If the server is defferent location/Subnet?

Thanks

Debu

[Surendra]

200ms is the tolerance.

[paul]

200 ms was the old guidance. In 2.1 and later it was change and to 300 ms.  Of course there are other factors other than latency.

[Debabrata Majhi]

Thanks Paul and all for make it sence ,

Paul,Can your please let me know some example of "other factors" which needs to be consider.Which will help us to design the cluster.

Thanks

[Jason Kunst · Accepted solution]

Have you reviewed scale and high availability or ise tips tricks

https://community.cisco.com/t5/security-documents/ise-training/ta-p/3619944#toc-hId-1281981443

[Jason Kunst]

please see https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-798633198