Performance & Scale implication of running Radius & TACACS+ on same PSN

[Abraham Joseph]

Does anyone know about how RADIUS / TACACS+ performance are affected if both services are run on the same PSN (SNS 3595). Has anyone looked into this before or know how the performance & scale figures for Radius and TACACS+ will be affected?

[Aravind Ravichandran · Accepted solution]

Hi Abraham,

Please refer the ISE Tacacs+ deployment & sizing guidance: https://community.cisco.com/t5/security-documents/ise-tacacs-deployment-amp-sizing-guidance/ta-p/3612253

As per the guidance document,for mixed PSN(Radius + Tacacs) in cons they have mentioned 

Load from Network Access may impact Device Administration services and vice versa

[Abraham Joseph]

Thanks Aravind, That is helpful.  I guess we do not have a specific number based on testing.   Think the following calculation given by Thomas is helpful to do some calculations.

[20 Device admin concurrent @ 1 command/s = 40 TPS  (command authz + acctng record)]

I am looking at a scenario where the customer roughly got around 10,000 endpoints and deployment is a fully distributed deployment. All nodes will be 3595 or 3595 equivalent.  PSNs will be running Radius + TACACS + pxGrid, I am assuming we will be good for up to 20,000 users.

[Nidhi]

Hello, 

I discussed this with engineering on this, this scenario was tested briefly with 90% TACACS+ and 10 % Radius traffic . 

the team did not observe any issues with TACACS performance and no Radius error  were seen either. 

For performance matrix on this platform, please refer the performance and scalability page  here- https://communities.cisco.com/docs/DOC-68347

Thanks,

Nidhi