ISE Mix/Match Distributed/Standalone Deployment Support

[Krzysztof Grabowski]

Hi Team,

I wanted to confirm if mix/match standalone with distributed deployment is supported. For example is a following 3 node installation supported: 

Node 1: PAN (P) + MnT (S) + pxGrid + PSN

Node 2: PAN (S) + MnT (P) + pxGrid + PSN

Node 3: PSN 

Cheers,
Chris

[Colby LeMaire · Accepted solution]

The official answer from Cisco will be that it is NOT supported.  But it will still work.  If you ever have to open a TAC case for anything, they may refuse to help until you fix the deployment model.

[cciesec2011]

---

@Colby LeMaire wrote:

The official answer from Cisco will be that it is NOT supported.  But it will still work.  If you ever have to open a TAC case for anything, they may refuse to help until you fix the deployment model.

---

Are you sure about this?  I have this deployment and it is recommended and supported by Cisco

Node 1:  Primary Admin, Secondary MNT, PSN

Node 2:  Secondary Admin, Primary MNT, PSN

What is the difference between my deploymnent and the original poster deployment, other than he has node 3 as PSN?

[Jason Kunst]

that's exactly the issue, a PSN outside of the other boxes. once you do that you have to move all PSNs external from PAN/MNT and then only may have up to 5 PSNs external. This is shown in BRKSEC-3432 https://cs.co/ise-training. also http://cs.co/ise-perf and deployment guides

[Colby LeMaire]

The additional third node as a PSN while still having PSN on the Admin/MnT nodes is the issue. That is a distributed deployment and the Admin/MnT nodes should be dedicated to those functions.