TACACS+ OVA guidance

[jmichale]

I have a customer that will be deploying ISE only for TACACS+ and they have asked what OVA image they should use - Medium or Large.

They will have over 4,000 devices.

They will not be using ISE for any endpoint devices.

Is there a document sizing guide to determine the appropriate OVA?

[paul]

The 3515 200 GB OVA should be plenty.  Here is the sizing guide. 

ISE Performance & Scale

[Craig Hyps · Accepted solution]

Actually it will depend on the required TPS and storage retention requirements.   If computer scripts are making changes daily to all 4k devices with Command AuthZ and Accounting, the 3515 with 200GB disk could easily be exceeded in terms of TPS and retention. 

In addition to the Performance and Scale page, see ISE TACACS+ Deployment & Sizing Guidance

The performance page does include TPS rates per platform as well as data retention data.  BRKSEC-3699 session (reference presentation) on ciscolive.com also provides more details on T+ sizing.

Craig

[jmichale]

Craig, thanks for the reply.  In the ISE Performance and Scale document there is only the SNS-3595 (Large) Hardware Appliance ISE Performance & Scale

The customer will be deploying ISE as a VM.

In the ISE 2.4 Installation Guide there are 2 different OVA's for the 3595 - Virtual SNS-3595 OVA (Medium) and Virtual SNS-3595 OVA (Large)

Cisco Identity Services Engine Installation Guide, Release 2.4 - SNS-3500 Series Appliances and Virtual Machine Require…

1) Are the ISE Performance Numbers in the "ISE Performance & Scale" doc for the SNS-3595 (Large) Hardware Appliance the same as the Virtual SNS-3595 OVA (Large).  Or stated another way, can we use the numbers in the "ISE Performance & Scale" doc for the Virtual SNS-3595 OVA (Large)?

2) For a TACACS+ only deployment can we use the Medium OVA - Virtual SNS-3595 OVA (Medium)?

3) Are there any performance numbers for the OVA deployments of ISE for a TACACS+ deployment?

[Craig Hyps]

The performance numbers refer to PSNs, not MnT nodes.  There is currently no plan to test the Large 3595 as a PSN in ISE 2.4.  The Large appliance is targeted for higher MnT performance specific to page and report loads.  It will also be a requirement if we release deployment scaling figures beyond 500k in the future.

1) For T+ scaling, use 3595 figures for deployment scale.  As noted, the large appliance would not be deployed as a PSN which dictates the per PSN scale sizing.  Each PSN logs to MnT which is where deployment scale is impacted.

2) Yes.  You can always choose between a hardware appliance or a VM equivalent.

3) Refer to the hardware equivalent performance figures as guidance.

Craig