ISE PIC Deployment

[Joe Montes]

Hi there,

Just want to clarify something on the admin guide it states the following:

"Enable the Passive Identity and pxGrid services on the dedicated Policy server (PSN) you intend to use for any of the Passive Identity services — Choose Administration > System > Deployment, open the relevant node, and under General Settings, enable Enable Passive Identity Service and pxGrid."

Does this imply I can run ISE-PIC services and pxGrid on the same node?

Cheers,

[hslai · Accepted solution]

Not exactly.

ISE (or full ISE) and ISE-PIC are two different products. They both are able to serve passive identity services. ISE-PIC is low-cost, passive identity only, and may integrate with other Cisco products (e.g. SMC 6.x) via pxGrid. The full ISE can do all those and a lot more.

For more details, see

• ISE 2.2 and ISE PIC Techtorial Part 1 at Cisco SalesConnect
• BRKSEC-3697 - Advanced ISE Services, Tips and Tricks (2017 Las Vegas)

[Joe Montes]

Hi Hsing,

Hi Hsing,

The question is based on a Full-ISE deployment and not stand-alone ISE-PIC.

Cheers,

[hslai]

To re-iterate our offline discussion, we may serve pxGrid and passive identity services on regular ISE nodes. No need to deploy ISE-PIC.

[Joe Montes]

Thanks legend!

☺