CWA maximum sizing

[Rich Yim]

I have a large Guest WiFi deployment which requirements for CWA are as below:

1)       100K guests per day, and their session can last for 7 days

2)       Estimated that our system to store for 1M guest information

I would like to explore whether ISE can support it.

-          How to scale out the CWA for ISE? (cluster support?)

-          How to sizing the ISE for the guest portal deployment?

3)   Some of the area are using 3^rd party WiFi solution (Motorola)

-          -            Can we support 3^rd party WiFi system?

4)  

C  Social media support (Facebook, WeChat, etc)

-         Can we support Social Media with our ISE system?

[Jason Kunst · Accepted solution]

Have you looked into service provider EMSP?? Is ISE really the best choice? This doesn't seem like a normal corporate type of scenario? Seems like conferences venues??

ISE supports 1M guests, 1.5M endpoints. For guest users might be ok, cutting it close as you would purge after 7 days. database might start getting full. Also have to look into endpoint purging

ISE Performance & Scale

ISE Third-Party NAD Profiles and Configs

We don't currently integrate with social media, please reach out to the ISE Product Marketing team through your sales channel.

[Craig Hyps]

100k guests each day, each active for 7 days, implies a rolling average of almost 5M active sessions per day.  I suspect actual requirement is way less.  Guest connections are typically shorter lived, even if account is usable for multiple days, or they are sporadically active across the time period that account is valid.  Therefore, concurrent active sessions at one time is usually far less.

The Perf & Scale link provides info to the Cisco Live session BRKSEC-3699 which has a section on scaling services.  ISE 2.1 scale to 500k concurrent active sessions.  The function which must be well designed is initial web auth.  Web auth rate is generally much less than 802.1X or basic MAB.  Therefore, it is recommended to leverage auto-registration and/or 802.1X with Guest accounts where possible.  For higher scale web auth, it is recommended to leverage multiple PSNs behind a load balancer.  Also, it having more "small" appliances can scale better than fewer "large" appliances from a transaction rate perspective.

/Craig