ISE Deployment - PXGrid and SXP Same Appliance

[julrober]

Hi 

I have a customer who has a question around deploying PxGrid and SXP personas on the same SNS-3655 appliance, they will have a pair for resiliency.

Our original plan was to deploy a dedicated ISE implementation, with

2x PAN (SNS-3655)

2x MnT (SNS-3695)

2x PSN (SNS-3655)

2x PxGrid (SNS-3655)

2x SXP (SNS-3655)

I did think about a hybrid deployment, but it does not scale. Therefore I was wondering if we could deploy as the following:

2x PAN (SNS-3655)

2x MnT (SNS-3695)

2x PSN (SNS-3655)

2x PxGrid & SXP (SNS-3655)

The specifications of the existing environment is:

Concurrent users: 20,000 (could grow to 40,000)

SXP peers: 15 (grow to 30)

SXP Binding: 6,000 (grow to 10,000)

PxGrid Subscribers: 7 @ version 1.0 (assuming will become version 2.0 after software update)

Any information or advice you could provide would be much appreciated

Kind Regards

Julia

[jj27]

You can validate your numbers against the ISE Performance and Scale document here: https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId-1191660208

[Jason Kunst · Accepted solution]

You cannot separate PSNs with admin/monitoring on the same box, Valid designs are also show in BRKSEC-3432 at http://cs.co/ise-training

[julrober]

Hi , thank you for the responses, my customer is looking for a bit more detail around the following:

" Can an environment have one node doing PxGrid and SXP and if so, what are the resource limits i.e. SXP bindings, peers etc. Assuming the figures in the scaling link are when one node is doing one function"

Can you please advise ?

Kind Regards

Julia

[Jason Kunst]

there is no numbers combining the two and hasn't been tested. Like other recommendations you can try and it may work but there are no numbers to support your scenario.