Passive Identity : supported #DC - clarification needed

[jdal]

Hi,

My customer has slightly more than 200 domain controllers to monitor via WMI for Passive Identity.

From

https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-1418220509

Max AD Domain Controllers supported via WMI or ISE AD Agent

100

It is not clear however if this limit is per PSN or per cluster. Could someone confirm?

If this is per PSN, does this mean the maximum number of DC we can monitor per ISE cluster is limited to 200:

Recommended # PSNs enabled for WMI (Passive ID service)

2

Is this a hard limit or does it just mean we haven't tested higher number? With the use of "recommended", it sounds like we could try to go higher...

Any chance to increase these numbers in the future (v2.5?)

TIA,

JF

[Timothy Abbott · Accepted solution]

JF,

The deployment limit is 100 controllers and a single PSN can monitor up to 100 controllers if that makes sense. 100 controllers is what we tested however we can scale beyond that using security event forwarding using GPO. I can't talk about roadmap in this forum, unfortunately.

Regards,
-Tim

[jdal]

Thanks Tim, I'll follow up internally for the roadmap.

[Greg Terkanian]

Timothy,

Can you provide more information or at least point me in the right direction for setting up event forwarding to support passive ID for a domain with more than 100 DCs?  I have information on event subscription, however it seems I can't specify the security event log as the destination.  Can the AD connector read from "forwarded events" on the subscriber?  If so, do I need to specify this somewhere in the configuration?

Thanks

Greg