We will upgrade our switches to IOS version 15.2(2)E4. Please check whether the ISE can work with our switches in case of bypass. And, the bypass (failover) mode setting?
You find this information on the Cisco Identity Services Engine Network Component Compatibility on cisco.com. There you can check it based on your switch models. In case you need a new version of the document, the search term is "ISE compatibility".
You suggested to use “SNS-3415 OVA”. However, The appliance 3415 will be eos soon. I afraid the support (and the cisco forum) on the model 3415 will become minority. How about if we use “SNS-3515 OVA”, and any considerations?
At least this was the former actual OVA to install from. Now where the 3515 is available you are free to use that (I would). For support, it's more important what you run inside your VM.
We are using static IP for end-user notebook now. And, if there is any changing on the notebook’s IP, it will update to our internal DNS server (in Windows AD) .
I would rethink this design. Nowadays you get the most security when you put as many clients as possible on DHCP (with or without reservation). With DHCP you can run additional security-services like DHCP-snooping and ARP-inspection. DHCP-Snooping is also important for your dACLs to work correctly.
