Cisco ISE on a VMware Server

[Jay233]

Hi All,

Quick question, ISE Bond Ethernet Interfaces for High Availability?

The NIC bonding feature is supported on all supported platforms and node personas  - supported platforms

• SNS 3500 and 3600 series appliances - Bond 0, 1, and 2
• VMware virtual machines - Bond 0, 1, and 2 (if six NICs are available to the virtual machine)
• Linux KVM nodes - Bond 0, 1, and 2 (if six NICs are available to the virtual machine)

I have bonded ISE running on SNS Appliances but not on a virtual server.

Has anyone bonded ISE interfaces on a virtual server that could let me know of the benefits, procedure or best-practice for deploying ISE on a VM with interface HA.

Cheers    

[Marcelo Morais]

Hi @Jay233 ,

 please take a look at the following links: Configuring NIC Teaming on a BE6K and NIC Teaming benefits.

Hope this helps !!!

[Panos Bouras · Accepted solution]

Hi @Jay233,

As ISE will be virtual I don't find any benefit from vNIC bond of VM interfaces, instead VMWare should have it's vSwitch physical NIC (Uplinks) bundled for HA. This way HA is handled at hypervisor level and no need to worry about the VM. If you need more than 1Gbps then go with VMXNET3 VM interfaces (just confirm correct interface numbering VM settings vs ISE OS).

[Jay233]

Hi Panos,

Appreciate your post, just needed to clarify and also why Cisco mention if it actually doesn't add any benefit.

The NIC bonding feature is supported on all supported platforms and node personas.

• SNS 3500 and 3600 series appliances - Bond 0, 1, and 2
• VMware virtual machines - Bond 0, 1, and 2 (if six NICs are available to the virtual machine)
• Linux KVM nodes - Bond 0, 1, and 2 (if six NICs are available to the virtual machine)

[Marcelo Morais]

Hi @Jay233 ,

"... the bonding of interfaces ensures that ISE Services are not affected when there is:

. physical interface failure

. loss of switch port connectivity (shut or failure)

. switch line card failure

When two interfaces are bonded, one of the interfaces becomes the primary interface and the other becomes the backup interface. When two interfaces are bonded, all traffic normally flows through the primary interface. If the primary interface fails for some reason, the backup interface takes over and handles all the traffic. The bond takes the IP Addr and MAC Addr of the primary interface ..."

Hope this helps !!!