Cisco ISE VM deployment

[network_geek1979]

Team, do you have some guidance for the ISE VM version deployment? We want to get the version 2.3 up and running.

This is a standalone installation. My first question is what NIC do I allocate for the VM on VMware?

The first one would be a management NIC I presume.

Also, can I download a test license key for the initial deployment?

Thanks!!

N.

[Rob Ingram]

Hi,

Cisco recommended using E1000 virtual nic, reference here. It depends on your deployment but you can probably get away with only having 1 NIC.

For licensing you do have the 90 day evaluation license built-in, so nothing to download.

HTH

[Arne Bier]

Hi @Rob Ingram - I would beg to differ on that E1000 recommendation.  E1000 is the last resort option.  The VMXNET3 paravirtual adapter has been around for years and it's also very much supported by Cisco and it works flawlessly with ISE VMs.  The benefit is that the paravirtual device offloads the hypervisor's CPU by not having to emulate the hardware.  In my opinion there is no reason NOT to use VMWNET3. In addition  I always deploy the storage adapter as PVSCSI, which is the SCSI Paravirtualised adapter.  Better performance for the Hypervisor.

[Damien Miller]

I think there is only one reason why vmxnet3 are not the default, something about possibly having to remapping them. Have you had to do this?

From the install guide.
"1 GB NIC interface required (two or more NICs are recommended). Cisco ISE supports E1000 and VMXNET3 adapters.

Note
We recommend that you select E1000 to ensure correct adapter order by default. If you choose VMXNET3, you might have to remap the ESX or ESXi adapter to synchronize it with the ISE adapter order."

[Arne Bier]

@Damien Miller I have never needed 6 GigEths on an ISE node and therefore I never run into this. With one or two interfaces the ordering is not an issue. Even if it were then I would find which interface matches the ISE interface. It’s not broken, it’s just inconvenient extra step perhaps. But your nose will run for years on paravirtualised adapter. To me that is time well spent. 

[ldanny · Accepted solution]

Please see Installation guide

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24_chapter_011.html#ID-1417-00000271

If you have a CCO account you can download an evaluation image which will provide up to 100 endpoints for 90 days with all services.

ISE 2.4 OVA file for 100 endpoint eval