ISE Design queries

[dngore]

Hi Team,

Want to check below design possibility for 25K users (will increase 20% - 30% in future)

• PAN-MNT on single 3695 node ( as per guide, it can support 50K in hybrid deployment)
• Two 3655 as PSN (can handle 25K sessions per PSN in hybrid deployment)

Will above sizing with mix of 3695 and 3655 work?

Second query: Can existing license (base, plus & Apex) from two ha ISE node setup can be re-hosted on new ISE setup (hybrid)?

[Damien Miller]

One slight correction on this. When you are running in a hybrid design, the dedicated PSNs will have the capacity of a true dedicated node but the deployment is limited by the shared PAN/MNT nodes.

So the 2x 3695's running PAN/MNT are providing you with a total 50k active endpoint capacity as you mentioned. The 2x 3655 PSNs actually have capacity to handle all endpoint auth on a single node, 50k per, giving you 100% HA in a N+1 fashion.

You don't want to exceed 50k scaling, but each PSN can handle a full 50K each. This would be a suitable design providing capacity for patching and node failure scenarios. You would ideally balance endpoint auth 50% and 50% to balance load 25k per PSN.

If this if scoping 4 physical SNS appliances then it's a good solution. If you are looking at hosting this virtual, there is another solution that could be viable. Most VM teams don't like 256 GB VMs. Running 2x 3695 and 2x 3655 requires 706 GB of memory. Running a full dedicated deployment requires 576 GB memory, but more 48,000 more Mhz CPU, and a bit more disk. It really depends what the customer can support.

2x 3655 PAN
2x 3655 MNT
2x 3655 PSN

[dngore]

Thx a lot Damien for quick reply. I got on sizing part.

How about re-hosting license from one setup to another? I think it is possible. Is it correct?

[Damien Miller · Accepted solution]

They are, traditional PAK licenses can be rehosted by the individual that fulfilled them on the licensing portal in a self service fashion. If that individual is no longer available, then TAC is able to assist with migrating the licenses.

An ideal alternative would be to get the licences converted to the customers smart license account if they are not already. This way multiple ISE deployments are able to leverage the same license pool at the same time. The exception being VM and TACACS node licenses where you need 1:1 based on deployed usage. It avoid the requirement to rehost / migrate licenses in the future.

[dngore]

Thx a lot for this helpful reply.