Configure Maximum Concurrent User Sessions on ISE 2.2

[priyadve]

I would want to know, whether the configuration of maximum concurrent users session is available for External identity source(Active directory)

In reference to the below link, my understanding is this option is right now available on ISE internal users alone and is not available for External:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/204463-Configure-Maximum-Concurrent-User-Sessio.html

1)Do we have any limitation with Maximum concurrent users using External identity source?

2)Any enhancement request raised for this configuration with ISE 2.3?

I see with ISE 2.3 as well we have this issue.

[Craig Hyps · Accepted solution]

Maximum users internal or external to ISE is not related to the maximum concurrent sessions.  Regardless of how many users or devices which may be stored in- or outside ISE, max sessions is number that can have active connections at any one time to a specific PSN or to overall deployment.  For example, ISE can store 1.5M endpoints in its database, but only 500k may have active sessions at one time.  Similarly, there may be millions of users in AD or LDAP store, but only 500k can be connected and have active session to ISE at any one point in time.  This also means that over a course of a day, we may have many more than 500k users/devices that authenticate to ISE, but limit is point in time.  Some competitors rate their sizing based on daily connections, not concurrent, and attempt to claim similar or higher scaling.  This logic is flawed since ISE could authenticate many millions in a 24-hr period.  Hope that clarifies.

Craig