ISE Distributed Deployment

[isabela]

How can i best structure a large deployment with three Data Centers?

[Marvin Rhoads]

There are many options Which is best for you depends a lot on your particular requirements.

You should start by reviewing this guide: https://cs.co/ise-scale

[Damien Miller · Accepted solution]

If it was my choice I would lay it out like this for a deployment that needs to support 25k+ active endpoints. You can increase the number of PSN nodes as the scale requires but the key component for me is that I would recommend putting the PSN nodes behind load balancers. This is not a hard requirement but this greatly simplifies the network device configuration since you can deploy all three load balancer virtual IP's to each network device in the order that makes sense. You can scale the deployment by adding PSN nodes without having to do much rework, and the maintanance/patching becomes much more transparent since network devices can have a VIP remain up with nodes being down. 

Primary DC 

• 1x Primary Admin Node
• 1x Primary Monitoring Node
• At least 2x Policy Service Node (behind a load balancer)
• 1x PxGrid Node if required

Secondary DC

• 1x Secondary Admin Node
• 1x Secondary Monitoring Node
• At least 2x Policy Service Node (behind a load balancer)
• 1x PxGrid node if required

Tertiary DC

• At least 2x Policy Service Node (behind a load balancer)