ISE 1.3 Distributed environment

[Augustgood]

Hi all,

in a network with two main campus and ten remote office with 3000 total device, for implement Cisco Ise 1.3 distributed, we want to buy 2 appliance SNS- 3415-K9 for management/monitoring/policy sync and 10 VM  for policy sevice node, but we found that in distributed environment we need a pair of inline posture node, we must buy other two appliance or VM for inline posture  ?? 

[jan.nielsen]

1.You should look through the ISE design guides, i believe that you should have MNT and PAN on different servers to support more than 5 dedicated PSN's. Having one 3415 as Primary PAN, Secondary MNT, and one as Primary MNT, Secondary PAN is only supported with up to 5 PSNs.

Distributed environment does not require inline nodes, and that functionality is also on the way out. What is the reason you think this would be required ?.Is it for a non-cisco network ?

Check this url for more information on scaling ise deployments :

http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/installation_guide/b_ise_InstallationGuide13/b_ise_InstallationGuide12_chapter_00.html#ID-1413-000000dc

[Augustgood]

Why this feature is on the way out ? is not a required,  but can be a customer request ? 

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_ipep_deploy.html#pgfId-1265599

But the secondary  MNT/PAN can manage 5 psn or work in standby ?

you are telling me that If one remote office fail, lose psn .... ?

[jan.nielsen · Accepted solution]

Well, it's not been officially said by Cisco, but it's already been removed from working on the SNS.3495, so i would say it's not something that one should design new ISE solution with.

No, the secondary PAN/MNT will manage the same PSNs as the primary, you can't divide your PSNs between PAN/MNT nodes.

"you are telling me that If one remote office fail, lose psn .... ?"

Not sure what you are asking,?

[Augustgood]

ok thank you

i ask you, if my PAm/mnt primary fail , my secondary can manage only the same psn of primary, not other

[jan.nielsen]

Yes, your primary and secondary PAN are the same, the primary replicates it's config to the secondary, so when the primary fails, the secondary takes over (only automatically from ise 1.4), they can't manage different PSNs.

[Augustgood]

other question ..

if my wlc rel 7.6 support  CoA i can exclude inline posture ??

[jan.nielsen]

Yes