I have a question regarding the deployment of the ISE-PIC agent. Is it

[GHOZLANE Haroun]

Hi Dears,

I have a question regarding the deployment of the ISE-PIC agent.
Is it possible (and supported) to install the ISE-PIC agent on an intermediate Windows Server instead of directly on the Domain Controllers?

If yes, can the communication between the ISE-PIC agent and the Domain Controllers be established using RPC or another protocol?
Or is it strictly recommended to install the ISE-PIC agent only on the Domain Controllers themselves?

Thank you in advance for your clarification.

Regards

[Ben Weber]

Hi @GHOZLANE Haroun 

As per the ISE-PIC administration guide, you are able to install the ISE-PIC agent on a member server (i.e. an intermediate Windows server) instead of the domain controller.

See: Cisco Identity Services Engine Passive Identity Connector Administrator Guide, Release 3.1 - Providers [Cisco ISE Passive Identity Connector] - Cisco for more information.

Good luck!

[Rob Ingram]

@GHOZLANE Haroun FYI, Cisco has announced EOL date for ISE-PIC, you may wish to consider another solution. https://www.cisco.com/c/en/us/products/collateral/security/ise-passive-identity-connector/ise-pic-eol.html#Overview