Are SXP mapping shared across a distributed ISE deployment?

[rmueller@cisco.com]

Hi all,

got a question from a customer: If one PSN is configured as SXP speaker, does this PSN see all SXP mappings from the whole deployment, or just the ones which this PSN did authenticate?

Bottom line of this question: Does SXP have to be enabled on all PSNs of a deployment (and an ASA has to peer with all PSNs to get the mappings), or would it be enough to enable SXP on one ore two nodes and peer with them?

Thanks in advance.

Roland

[hslai]

moved from Identity Services Engine (ISE) to TrustSec

I believe the former is correct. The PSN with SXP enabled should be able to see all mappings.