11-15-2018 04:46 PM
The performance and scale document shows that the max number of PSN's in a deployment is 40 for a 3495 as PAN and 50 for a 3595 as PAN.....In a VM environment of 2.3 with an OVA for 3495 on all does this mean that you can re image each admin node with a 3595 OVA to extend to 50 leaving the PSN's alone with 3495 images? We're at 39 Nodes that include 2x admin and 2x MnT, 35 PSN's so I'm trying to plan ahead what adding 5 more PSN's may look like.
Also do Node Groups lower or raise that number?
Solved! Go to Solution.
11-15-2018 10:45 PM
11-16-2018 06:48 AM - edited 11-16-2018 06:52 AM
For years we have been stating this method
You can change the CPU and the memory on a VM just not the disk (build a new node and add to the deployment to replace the node)
Node groups are used for performance and doesn’t change scale. Please see ise performance and scale Cisco live on this page
https://community.cisco.com/t5/security-documents/ise-training/ta-p/3619944
01-10-2019 08:31 AM - edited 01-10-2019 08:32 AM
I think your TAC case likely on some older ISE release. I am pretty sure ISE 2.4 will adjust the parameters after the CPU/RAM resized. Even an older ISE release will update the parameters if a change made to the persona(s) of the ISE node.
Besides the optimization done with the system parameters, ISE and the underlying Linux will still take some advantage of the enlarged RAM allocation.
11-15-2018 10:45 PM
11-15-2018 11:24 PM
Hi,
I guess instead of reimaging the VM, you can extend the VM sizing similar to 3595.
-Aravind
11-15-2018 11:53 PM
11-16-2018 03:00 AM
11-16-2018 05:49 AM
I would like to know how the claim "ISE doesn't use the extra CPU/memory" was verified. If I shut down a VM and change the memory/CPU, start it up again and look at the ISE counters it correctly recognizes it, i.e. it goes from UCS_Large to SNS_3595.
11-16-2018 06:48 AM - edited 11-16-2018 06:52 AM
For years we have been stating this method
You can change the CPU and the memory on a VM just not the disk (build a new node and add to the deployment to replace the node)
Node groups are used for performance and doesn’t change scale. Please see ise performance and scale Cisco live on this page
https://community.cisco.com/t5/security-documents/ise-training/ta-p/3619944
11-16-2018 08:31 AM - edited 11-16-2018 09:30 AM
The documentation states that it can be, but at least two different blogs have stated that it will likely cause adverse effects:
https://www.network-node.com/blog/2017/10/7/ise-design-going-above-the-configuration
https://www.ise-support.com/2017/12/23/vmware-and-cisco-ise/
Maybe they're wrong, maybe they aren't, but that's their experience even though the documentation clearly says otherwise. It would be interesting to know how they came to their conclussions. Any chance you can chime in @katmcnam (the first blog is hers)?
11-16-2018 08:35 AM
01-10-2019 08:16 AM
From what I was shown by a TAC engineer during troubleshooting, and they had to get root access to the file system, the sizing is written to a config file during ISE install/setup. It reads the virtual hardware and sets all of the configuration limits (ie database performance/resources) based on those. The configuration file doesn't get re-written if you shut down the VM, add CPU/RAM, and start it back up. All of the old limits are in place even with the additional hardware. Hence, "ISE doesn't use the extra CPU/memory" as in it is not fully utilized.