Accepted Solutions
These exact topics have been covered by @Charlie Moreton in our recent ISE Webinars which get archived to our ISE YouTube Channel:
▷ Cloud Load Balancing with ISE 2023/06/15, GitHub: ISE_in_MultiCloud_Webinar
▷ ISE in a Hybrid Cloud Environment 2022/12/06, GitHub: Cloud_Based_Load_Balancers
There is also a document for Deploy Cisco ISE Natively on Cloud Platforms which includes Cisco ISE on Azure Cloud Services as you requested.
People regularly ask for an "ISE in the Cloud CVD". 90% of the architecture decisions have nothing to do with ISE and are all about the same old routing, redundancy, high availability, and security practices for any applications or services in any datacenter. The Cloud is just another set of datacenters for ISE nodes. You may mix and match your ISE nodes to be deployed in any on-premise data or cloud provider as long as you use the supported appliances or VM hypervisors or cloud instances.
- Regions: Yes, for redundancy! How many? Which ones? Depends on the geography and scale of your organization
- Availability Zones: Always a cloud best practice. How many? Which ones? See Regions above.
- VPNs: Yes! RADIUS and TACACS are 30-year old protocols and do not have encryption therefore it is critical to use a VPN to secure all traffic. Which one depends on the customer's preferences, needs, and of course budget:
- static VPN gateway per VPC to one or more locations
- Cisco vASA in the cloud and/or on premises
- Meraki vMX with auto VPN in the cloud and/or on premises
- other physical or virtual VPN(s) in the cloud and/or on premises
- Load Balancing:
- this is probably a given for large scale deployments
- But even for small, 2-node ISE deployments in the cloud for Blue/Green deployments during upgrade and allow the load balancer VIPs to remain unchanged on all of your network devices. Unless you want to change the RADIUS configuration on all network devices with every ISE upgrade or tediously manage taking one PSN down and starting another with the same IP. 8-)
- Which network load balancer (brand, model, size, physical or virtual, etc.) is a customer choice and independent of ISE
- Security Groups: Yes, but exact rules depends on your network architecture decided above and which ISE services you run on which nodes. See the Cisco ISE Ports Reference for a complete list.
The official Cisco ISE on AWS Reference Deployment and ISE on AWS QuickStart Deployment Guide give you the template architecture that you should be able to apply with any cloud provider.
All ISE cloud instance have a Bring Your Own License (BYOL) model which is the same for any on-premises deployment. All licensing is done via the ISE PAN nodes whether on-premises or based in a cloud environment.
For the hourly cost of the various VM instances in the cloud environments, you may estimate it based on the suggested instance sizes @ Deploy Cisco ISE Natively on Cloud Platforms > Cisco ISE on Azure Cloud Services. Additional costs may be billed by your cloud provider(s) for data traffic and other related services (VPN, load balancing, DNS, etc.).
These exact topics have been covered by @Charlie Moreton in our recent ISE Webinars which get archived to our ISE YouTube Channel:
▷ Cloud Load Balancing with ISE 2023/06/15, GitHub: ISE_in_MultiCloud_Webinar
▷ ISE in a Hybrid Cloud Environment 2022/12/06, GitHub: Cloud_Based_Load_Balancers
There is also a document for Deploy Cisco ISE Natively on Cloud Platforms which includes Cisco ISE on Azure Cloud Services as you requested.
People regularly ask for an "ISE in the Cloud CVD". 90% of the architecture decisions have nothing to do with ISE and are all about the same old routing, redundancy, high availability, and security practices for any applications or services in any datacenter. The Cloud is just another set of datacenters for ISE nodes. You may mix and match your ISE nodes to be deployed in any on-premise data or cloud provider as long as you use the supported appliances or VM hypervisors or cloud instances.
- Regions: Yes, for redundancy! How many? Which ones? Depends on the geography and scale of your organization
- Availability Zones: Always a cloud best practice. How many? Which ones? See Regions above.
- VPNs: Yes! RADIUS and TACACS are 30-year old protocols and do not have encryption therefore it is critical to use a VPN to secure all traffic. Which one depends on the customer's preferences, needs, and of course budget:
- static VPN gateway per VPC to one or more locations
- Cisco vASA in the cloud and/or on premises
- Meraki vMX with auto VPN in the cloud and/or on premises
- other physical or virtual VPN(s) in the cloud and/or on premises
- Load Balancing:
- this is probably a given for large scale deployments
- But even for small, 2-node ISE deployments in the cloud for Blue/Green deployments during upgrade and allow the load balancer VIPs to remain unchanged on all of your network devices. Unless you want to change the RADIUS configuration on all network devices with every ISE upgrade or tediously manage taking one PSN down and starting another with the same IP. 8-)
- Which network load balancer (brand, model, size, physical or virtual, etc.) is a customer choice and independent of ISE
- Security Groups: Yes, but exact rules depends on your network architecture decided above and which ISE services you run on which nodes. See the Cisco ISE Ports Reference for a complete list.
The official Cisco ISE on AWS Reference Deployment and ISE on AWS QuickStart Deployment Guide give you the template architecture that you should be able to apply with any cloud provider.
All ISE cloud instance have a Bring Your Own License (BYOL) model which is the same for any on-premises deployment. All licensing is done via the ISE PAN nodes whether on-premises or based in a cloud environment.
For the hourly cost of the various VM instances in the cloud environments, you may estimate it based on the suggested instance sizes @ Deploy Cisco ISE Natively on Cloud Platforms > Cisco ISE on Azure Cloud Services. Additional costs may be billed by your cloud provider(s) for data traffic and other related services (VPN, load balancing, DNS, etc.).
