ISE PSN Positioning

[fatalXerror]

Hi Guys,

My AD, DNS, CA, and PAN/SAN are in my DC. Should I position my PSNs locally at my offices or should I deploy it in the DC also closer to the PAN, AD, DNS, etc.? Which is best?

Thank you

[M02@rt37]

Hello @fatalXerror,

If network latency is a concern, deploying the PSNs closer to these components can reduce the latency and improve performance.

Also, evaluate your security requirements and the sensitivity of the traffic between the PSNs and other components. If the communication between PSNs and the PAN, AD, DNS, etc., involves sensitive data, it might be preferable to keep the PSNs within the controlled environment of the data center.

[fatalXerror]

Hi M02@rt37 , thank you for your reply but what if I will associate also my guest access, will it be okay if my PSN in the DC rather than deployed locally in the office site? Thank you

[Aref Alsouqi]

That is absolutely fine. Usually we don't deploy ISE nodes in the offices, usually we deploy them on cloud or in the DCs, depending on the deployment, you might want to redistribute them across multiple region, and the latency between ISE nodes shouldn't be higher than 300 ms.

[M02@rt37]

Hello @fatalXerror,

By deploying ISE nodes in data centers, you can leverage the scalability and flexibility offered by these environments. Additionally, centralized management simplifies administration tasks and allows for consistent policies and configurations across the network.

Overall, deploying ISE nodes in data centers aligns with industry best practices and can provide a robust and efficient identity and access management solution for your organization.

[fatalXerror]

Hi M02@rt37 / @Aref Alsouqi , in the security standpoint, is it advisable to deploy PSN with guest services in offices in DMZ zone so that guest auth will no go through all the way to DC?

[Aref Alsouqi · Accepted solution]

It doesn't really matter much if you deploy the PSN in the office or in the DC from that perspective. However, what does matter would be the guest traffic flow design. Personally I always try to dedicate an interface on the PSN to serve the guest traffic, and obviously that traffic would need to be segregated at L2 as well as denying any traffic from the guest network to your RFC1918 with the exception for ISE guest portal, and maybe the DHCP traffic.

In that case when a guest tries to connect to the guest network they will be redirected to the PSN portal which is poiting to the PSN dedicated interface, and ISE will reply back to the guests out of that interface. This way the guests won't be able to see ISE management private IP at all and they won't be able to hit the management console all the way.

[MHM Cisco World]

Yes cisco recommend to put PSN in DMZ.
but be sure that there connect between PSN and PPAN/SPAN

[MHM Cisco World]

https://community.cisco.com/t5/network-access-control/design-clarification-for-ise-pan-mnt-personas/td-p/3574288

check this link which confirm you add PST locally and add PPAN/SPAN in DC