09-26-2019 12:17 AM - last edited on 03-13-2020 04:06 PM by Kelli Glass
Hello Experts!
I'm currently using three 3595 ISEs.
I want to add another 3615 here as a PSN.
Currently information
ISE1 : PAN(Primary) + MNT(Secondary) + PSN
ISE2 : PAN(Secondary) + MNT (Primary) + PSN
ISE3 : PSN (Health-Check node)
Is there problem to use?
Solved! Go to Solution.
09-27-2019 11:01 AM
09-28-2019 02:32 AM
@Damien Miller - I don't believe @likewinered intention was to run three PAN/MnT combos - there is no way to even try to select such a function. What they were asking was whether adding a PSN to a deployment consisting of two PAN+MnT+PSN would be a problem.
The official Cisco deployment guide says this is not allowed and the "next steps" for customers who wish to expand by ONE PSN from a 2 node all-in-one system, is to buy three more nodes:
Existing Deployment:
to
This is the official stannce but I know customers who are simply adding a third node for simple stuff like Guest Portals. Why would anyone in their right mind buy three ISE nodes just so that their system can add one more PSN for Guest Portal functionality? The load will be negligible and Cisco should be more clear on the technical reasons why this is a bad idea. I think it's a great idea. If a TAC engineer can prove to me that I have broken the system by doing this then I will concede that it's wrong. Of course I would never want to have a two node system hammering away at 40,000 concurrent sessions and then dare to add another PSN to that. That would probably end badly.
The ISE Deployment "models" are very rigid and not everyone wants to split off their PSN from the PAN/MnT, or even go fully distributed. Sometimes the PSN is just there for fallback in emergency and may do very little work.
I have seen a fair bit of "creative deployments" in the field that don't fit the Cisco model and they work very well. The TAC have even supported them, and since the issues we were having were not related to scale-out or load, the TAC didn't object.
I guess my point is simply that in a world of infinite resources (hardware/VM/money) just do what Cisco tells you - but these rigid guidelines are not founded on a lot of technical argumentation, other than "not tested by Cisco". But that is no good reason not to run such a setup, if, as I say, the load is minimal. I could imagine 6 PSN's each doing around 500 concurrent sessions all linked to a PAN+MnT+PSN combo would still perform better than a PAN+MnT+PSN combo doing 40,000 concurrent sessions. Therefore it's not the number of PSN's that kills a system.
09-26-2019 10:11 PM
Hi @likewinered
Not a problem - you are using ISE 2.4 on the existing network?
When registering a node, the new (soon to be added) node needs to have the same software and patch level as the rest of the deployment
09-30-2019 06:43 PM
Yes. I using ISE 2.4.
Thanks for your reply.
09-27-2019 11:01 AM
09-28-2019 02:32 AM
@Damien Miller - I don't believe @likewinered intention was to run three PAN/MnT combos - there is no way to even try to select such a function. What they were asking was whether adding a PSN to a deployment consisting of two PAN+MnT+PSN would be a problem.
The official Cisco deployment guide says this is not allowed and the "next steps" for customers who wish to expand by ONE PSN from a 2 node all-in-one system, is to buy three more nodes:
Existing Deployment:
to
This is the official stannce but I know customers who are simply adding a third node for simple stuff like Guest Portals. Why would anyone in their right mind buy three ISE nodes just so that their system can add one more PSN for Guest Portal functionality? The load will be negligible and Cisco should be more clear on the technical reasons why this is a bad idea. I think it's a great idea. If a TAC engineer can prove to me that I have broken the system by doing this then I will concede that it's wrong. Of course I would never want to have a two node system hammering away at 40,000 concurrent sessions and then dare to add another PSN to that. That would probably end badly.
The ISE Deployment "models" are very rigid and not everyone wants to split off their PSN from the PAN/MnT, or even go fully distributed. Sometimes the PSN is just there for fallback in emergency and may do very little work.
I have seen a fair bit of "creative deployments" in the field that don't fit the Cisco model and they work very well. The TAC have even supported them, and since the issues we were having were not related to scale-out or load, the TAC didn't object.
I guess my point is simply that in a world of infinite resources (hardware/VM/money) just do what Cisco tells you - but these rigid guidelines are not founded on a lot of technical argumentation, other than "not tested by Cisco". But that is no good reason not to run such a setup, if, as I say, the load is minimal. I could imagine 6 PSN's each doing around 500 concurrent sessions all linked to a PAN+MnT+PSN combo would still perform better than a PAN+MnT+PSN combo doing 40,000 concurrent sessions. Therefore it's not the number of PSN's that kills a system.
09-30-2019 09:30 AM
09-30-2019 12:00 PM
Just to chime in here. We have had customers for years running the 3 node deployment where they needed an extra PSN for various reasons. There is no technical reason to not do this. It works just fine. The only reason, as has been said, is it is not a supported model by Cisco. I don't recommend a deployment model outside of the 3 supported models, but technically it works just fine.
09-30-2019 06:51 PM
Thank you everyone!
I think my explanation is a bit lacking.
This is the composition I want to use.
ISE1: PAN + MNT + PSN
ISE2: PAN + MNT + PSN
ISE3: PSN (Health check node)
ISE4 (New 3615): PSN
The bottom line is that although this configuration is not recommended by Cisco, it does not seem technically problematic.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide