Hello,
First I thought I posted a discussion with some of the following questions earlier in the week, but I cannot find it anymore, so apologies if they are duplicate.
A customer is starting a PoC for ISE, but looking for a word wide implementation, and has some questions in preparation for it.
- performance values for retrieving authorization information from LDAP. We consider using LDAP as replacement for AD for authorization purposes (for domain users and domain computers) and we can only find authentication performance in available documentation, not authorization
- if we replace internal endpoint database with ODBC database, we would need to know (documentation provided by Francesca shows examples for user attributes retrieval only)
- performance values for retrieving authentication and authorization attributes from ODBC
- possibility to retrieve endpoint attribute and use it in authorization profile for:
- for VLAN assignment
- for matching site code in the endpoint record with site code of NAD, where the authentication is coming from
- we believe we have read that in complex deployments Policy nodes can be manually configured by TAC so that each of the policy nodes at site will join different domain controller to overcome an issue where all policy nodes authenticate and authorize users at the same AD controller which will become overloaded. Is it right? Is there such possibility?
- scalability of the SW-Version attribute in the NAD record. The reason is that we need to store location code to each NAD and if we do it by NDG then the limit is ~20.000 NDGs and we have ~40.000 locations. That is why we selected SW Version attribute, one of few that can be used in authorization rules as matching attribute. How many distinct values can be stored there?
- is it possible to extend NAD attributes somehow (dictionary?) and use these attributes in the authorization policies as matching attributes? If so, how they scale?
- performance/scalability values for API
- NMAP scalability values. Is there a way to control the number of NMAP scans that ISE will launch, and how can we be use it will not create issues in ISE or the network if we enable that probe?
Thanks in advance
