Exceeding ISE Performance and Scale - what happens then?

[Arne Bier]

Hello all,

I am referring to the ISE Performance and Scale page that possibly has the highest page views because it's an excellent page and a much debated topic.

I have seen customers operating ISE deployments that go beyond the limits of what is allowed, and so far I have never observed that their ISE deployments were suffering because of it.  e.g. customer started off with two Standalone SNS-3595 appliances and over time a third PSN has been added - not supported (apparently) but works great (all three nodes running Services). Other examples include Hybrid deployments where the number of PSNs exceeds the max of 5. Again - no issues at all. Happens all the time.

My question is whether customers are allowed to (at their own risk) to deploy such non standard solutions because the software doesn't prevent them from doing so? And when I say "allowed to", I am referring to the TAC support.

Let's stay with ISE 2.7 and older: It's quite a financial jump for customers to grow from 5 PSNs to 6 PSNs and possibly even 7 PSNs - because they would strictly speak have to deploy 1 extra PAN and 1 extra MNT. Considering that the additional PSN nodes may only handle very low amounts of traffic, I personally don't see why an additional PAN/MNT is required - other than, because Cisco says so. It never seemed to be based on any real fact. If the number of concurrent sessions starts to ramp up then of course there will be a problem. But surely there has to be some flexibility given to customers to allow them to expand their lightly loaded PSN's beyond 5 without having to invest in another PAN and MNT.  I am aware that ISE 3.0 now allows 6 PSNs.

If my customer is adamant that they want to grow their PSN's beyond the max in a hybrid deployment, then who (at Cisco) should they talk to for the official stance and consequences of doing so? Community Web page links don't seem to carry as much weight as an official Cisco.com article, or an email from the Cisco BU. Personally I'd like to see the latter.

thanks

[thomas · Accepted solution]

@Arne, we are coincidentally in the process creating a new ISE Performance and Scale doc that will be posted on cisco.com!

I expect it to be a few more weeks as it is undergoing review.

Once posted, the old ISE Performance & Scale doc will be archived an redirect anyone to the new doc.

People can - and do - deploy and use ISE in a number of non-recommended and in some cases unsupported ways. Usually it is unintentional and TAC provides the guidance to correct it.

If someone wants to intentionally and routinely go over the rated capacities we cannot stop them.

But they must also be willing to risk and accept

• high authentication latencies
• dropped or failed authentications
• RADIUS server failure messages from network devices
• a slow ISE interface and/or reporting
• angry users
• other potential side effects including bad reputation, perceived incompetence, and job loss

[Marcelo Morais]

Hi @thomas ,

 excellent news about a new ISE Performance and Scale, an awesome doc !!!

 Since it is in undergoing review, could the responsible for the review double check the Posture Authentication values under Scenario-Based Performance?

SNS-3595 (Auths/sec): 70

SNS-3655 (Auths/sec): 51 (I expected a greater value than the SNS-3595)

Thanks a lot !!!