Network Infrastructure QoS Reference Guide for large distributed ISE deployment

[Ping Zhou]

I have a customer deploying 8+ nodes distributed ISE deployment. After gone through the CiscoLive 3699-RG presentation, and knowing the 200 ms delay, we're looking for some case study or reference guide on how to implement networks QoS for better supporting a large distributed ISE deployment that runs RADIUS and TACACS+. ISE nodes in the cluster use a very large number of TCP / UDP ports for different use cases. With traditional MQC method, we need to understand which ports are critical, important and best effort, etc.

[kthiruve · Accepted solution]

The delay of 200ms is reduced further to 300ms in ISE 2.1. Here is the link for the BW calculator

https://communities.cisco.com/docs/DOC-64317

Here is the ISE document that describes the ports open per service. These are critical to the services being used across deployment . If you are using different ports for the RADIUS/TACACS+ service that needs to be opened.

http://www.cisco.com/c/en/us/td/docs/security/ise/2-2/install_guide/b_ise_InstallationGuide22/b_ise_InstallationGuide22_chapter_0110.pdf

You need Administration, replication to happen including (Jgroups). You also need NTP, DNS, RADIUS, CoA and TACACS+ ports to be open. You need ports open for external ID store(if using AD etc) and logging. Turn on ports on profiling based on the probes used(Do SNMP poll per server to minimize traffic). Rest turn on based on the services/portals being used being used across deployment. It make sense to open 443 since it is used for a lot of communication. If you are not using profiling but still want to monitor the resources SNMP needs to be open.

Hope this clarifies.

Thanks

Krishnan