Solved: ISE Design question - scalability

thilinar8 · ‎08-06-2019

Hi,

Hope someone could help me.

we are in a process of deploying ISE in our organization. we got over 80 branches worldwide.

we will be deploying Large scale deployment. But, due to the Budget constraint, management is looking to cut-down the number of PSNs. But, i need to give solid technical explanations why we need x number of PSNs.

Solution:-

ISE PAN (HA)

MNT - Single Node

2 Main PSN (HA) - one PSN per Data centre

* latency is less than 300ms for All the branches when

* we have few sites with nearly 100 staff and others vary between 5-50

**************************************************************************

Do we need PSN for each site where number of users are high (close to 100)

what are the base requirements to put a PSN in a remote site?

howon · ‎08-07-2019

For 100 sessions, I would not recommend hosting a local PSN. If the concern is around network access during ISE failure, I would suggest looking into designing the network for fail open in case of ISE failure. Although the decision to have local PSN can be based on many factors, such as WAN quality, existence of AD server, # of users and endpoints, but generally would not need to consider one unless there are more than 3k concurrent sessions at a single location. Also, I would suggest that you also make MnT node HA pair.

View solution in original post

Damien Miller · ‎08-07-2019

I have some customers that want ISE nodes at critical facilities, but I would argue that this should be handled a different way. If a site is so critical that it requires a dedicated ISE node, it should have two WAN circuits, two routers, and you should have ISE hosted in two data centers. This way you have survivability via two fault domains.

Authentication latency below 5 seconds is typically fine, users will have many other issues if you link wasn't capable of this. Authentication traffic load is typically quite low. I would avoid placing PSNs at remote sites unless there is an absolute need.

I am with @howon, I would go even further and look at having just two nodes, one in each data center hosting admin, mnt, and psn roles. Two node deployments are able to scale between 7500 and 50,000 active endpoints depending on the ISE version and template deployed.

View solution in original post

howon · ‎08-07-2019

For 100 sessions, I would not recommend hosting a local PSN. If the concern is around network access during ISE failure, I would suggest looking into designing the network for fail open in case of ISE failure. Although the decision to have local PSN can be based on many factors, such as WAN quality, existence of AD server, # of users and endpoints, but generally would not need to consider one unless there are more than 3k concurrent sessions at a single location. Also, I would suggest that you also make MnT node HA pair.

Damien Miller · ‎08-07-2019

I have some customers that want ISE nodes at critical facilities, but I would argue that this should be handled a different way. If a site is so critical that it requires a dedicated ISE node, it should have two WAN circuits, two routers, and you should have ISE hosted in two data centers. This way you have survivability via two fault domains.

Authentication latency below 5 seconds is typically fine, users will have many other issues if you link wasn't capable of this. Authentication traffic load is typically quite low. I would avoid placing PSNs at remote sites unless there is an absolute need.

I am with @howon, I would go even further and look at having just two nodes, one in each data center hosting admin, mnt, and psn roles. Two node deployments are able to scale between 7500 and 50,000 active endpoints depending on the ISE version and template deployed.

thilinar8 · ‎08-07-2019

Hi Howton and Damien,

Thanks you so much for your Valuable advise