Number of External Syslog servers supported on ISE

[Aastha Chaudhary]

Hi Team,

I have a customer enquiring about the maximum number of Remote Logging Targets supported by ISE. Of course, this number would be dictated by the size of the deployment, however are there any performance numbers available we can share with customer. They currently have 7 Logging  Targets enabled -

Primary MNT
Secondary MNT
Bay Dynamics
ArcSight
2.2 ISE Node as an External Syslog
2.3 ISE Node as an External Syslog
Profiler RADIUS Probe

TACACS Authentication/Day = 3.1 million 
RADIUS Authentications/Day = 286,000

Please advise.

Thanks,
Aastha

[howon · Accepted solution]

I don't believe we have specific numbers on this and reached out to someone who may have an answer to provide answer.  However, have you considered using external host such as UDP duplicator or syslog-ng to duplicate the syslog messages? If this is distributed deployment, each PSN nodes may source syslog traffic which means you may need to configure your syslog receivers for all ISE IP addresses, but by using single host to duplicate/proxy, it may save network bandwidth and from complex configuration.

[Nidhi · Accepted solution]

As Hosuk mentioned, we do not have any performance numbers for max syslog targets But we do have close to 15 external syslog collectors configured in our test network. 

Thanks,

Nidhi

[Nidhi · Accepted solution]

As Hosuk mentioned, we do not have any performance numbers for max syslog targets But we do have close to 15 external syslog collectors configured in our test network. 

Thanks,

Nidhi