cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

263
Views
0
Helpful
2
Replies
Highlighted
Cisco Employee

ISE deployments and VMs requisites

Hi Team,

I have a customer who is thinking in ISE deployments, but they want to create 3 clusters:

1-. 1 PAN + 1 MnT + 9 PSN

2-. 1 PAN + 6 PSN

3-. 1 PAN + 6 PSN

 

I know when we deploy distribute environment we use to install 2 PANs and 2 MnTs for HA and the PSN according to endpoints or distribution, but I never see deployments without MnT nodes.  Is this possible ?

 

Other point,  what are the VMs requirements ?   I found the details about CPU and Memory related to VMS or VMM, but the requirements about disks are not clear.  What are the IOPs requirements for VMS or VMM in PAN, MnT or PSN ?

 

Thanks in advance.

 

Guillermo.

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
VIP Advisor

Re: ISE deployments and VMs requisites

A point of contention for me is no clear guidance on iops, but it's also different in every deployment based on load. ISE requires a minimum of 300 MB/s read, and 50 MB/s write but that's just a "good to have" number. I do not recommend raid 5, I have had issues where it passes the sequential 300/50 throughput test, but isn't able to write fast enough to keep up with logs. No disk alarms get sent but the MNT wasn't working. As for disk size, there is guidance in the install guide.

I would always want to run a deployment with 2 admin nodes in a deployment. If you have 1 PAN and it dies, you have to rebuild the deployment, I would want to avoid this because it's a huge work effort. I strongly recommend two admin nodes.

Having 1 MNT wouldn't be too bad since it's easy enough to rebuild and join, you would just lose historical logs. Having no MNT wouldn't be fun. You have no way to troubleshoot endpoint authentication issues or self monitor the deployment. I haven't even looked to see if it's possible to run with no MNT long term, I just know that when we have both MNTs down, it's an eerie feeling riding in the night, and I would not want to do this.

What active endpoint counts are you looking at for the three deployments? What is the reason for splitting them apart?

View solution in original post

2 REPLIES 2
Highlighted
VIP Advisor

Re: ISE deployments and VMs requisites

A point of contention for me is no clear guidance on iops, but it's also different in every deployment based on load. ISE requires a minimum of 300 MB/s read, and 50 MB/s write but that's just a "good to have" number. I do not recommend raid 5, I have had issues where it passes the sequential 300/50 throughput test, but isn't able to write fast enough to keep up with logs. No disk alarms get sent but the MNT wasn't working. As for disk size, there is guidance in the install guide.

I would always want to run a deployment with 2 admin nodes in a deployment. If you have 1 PAN and it dies, you have to rebuild the deployment, I would want to avoid this because it's a huge work effort. I strongly recommend two admin nodes.

Having 1 MNT wouldn't be too bad since it's easy enough to rebuild and join, you would just lose historical logs. Having no MNT wouldn't be fun. You have no way to troubleshoot endpoint authentication issues or self monitor the deployment. I haven't even looked to see if it's possible to run with no MNT long term, I just know that when we have both MNTs down, it's an eerie feeling riding in the night, and I would not want to do this.

What active endpoint counts are you looking at for the three deployments? What is the reason for splitting them apart?

View solution in original post

Highlighted
Cisco Employee

Re: ISE deployments and VMs requisites

Thx Damien,

I´m checking with the customer to understand why this configuration of deployments.

I only suggest the 2xPAN and 2xMnT in deployments.  It is the first time that I see this configuration, and the documentation don´t mention about the mandatory requirement of MnT.  I´ll explain to the customer and I´ll suggest the MnT with HA in all deployments.