Distributed ISE deployment, localised Identity source

[pehi030670]

Hi,

I'm trying to design a DMZ and security architecture that will incorporate a distributed deployment of ISE.

Assuming that each network segment will have a PSN deployed locally within it, is there any way to configure an individual PSN to consult the local network segment domain controller and name resolution service rather than having to open the firewalls to let every deployed PSN look "up" to a DC elsewhere on the network?

I've attached a concept sketch of what I want to achieve.

Thanks,

[Rob Ingram · Accepted solution]

Hi,

ISE is Active Directory Sites and Services aware, so if you configure the ISE subnet in the same site as the local DC it should query this local DC. Whether at somepoint the ISE would need to query another DC is a good question and may need further investigation.

HTH

Rob

[ajc]

I would say the answer is yes but still you need to open firewall for traffic between PSN's and Admin Nodes regarding for instance, authentication logs. In addition to that, NTP running for example on windows DC does not work well with ISE devices. Take this into consideration.

[pehi030670]

Thanks - As per the correct answer, location awareness via AD should give a predictable pattern to build an ACL on. For info's sake - the Microsoft registry hacks to turn a Windows server into an NTP server have worked pretty well for me.

[agrissimanis]

Just to add to the discussion - you can also specify preferred DCs for each PSN using the AD connector Advanced Tuning tool. It is usually recommended to rely on AD sites though.

[pehi030670]

That's good to know - thanks

[ajc]

We have had issues with the ISE synchronizing NTP with the Win Domain Controller. Do you have any link so I can check the tweak you mentioned?