SXP scale numbers for ISE 2.6 and 36xx series appliances

[giosif]

Hi,

Can someone please let us know the SXP scale numbers for the ISE 2.6 and for the 36xx series appliances, if available?

We are in the process of evaluating the right HW platform and SW version for a project and SXP performance is one of the driving factors in the decision.

Thank you!

[Jason Kunst · Accepted solution]

Numbers haven’t changed for 2.6

Please reference cisco live Melbourne 2019 deck
https://community.cisco.com/t5/security-documents/ise-training/ta-p/3619944#toc-hId-1281981443
and this page
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148#toc-hId--235887318

[giosif]

Thanks, Jason!

Is that true also for a hybrid deployment with shared RADIUS+SXP PSN's?

For that, I've got 200 SXP peers and 10,000 bindings, when using 3595's with ISE 2.4 (for all personas).

Are we looking at the same numbers for 3655 / 3695 for PAN & MnT and 3655 for the shared PSN's with ISE 2.6?

The slide deck doesn't appear to detail those cases.

[Jason Kunst]

Full slide deck exported here

http://cs.co/BRKSEC-3432

slide 429 432

I have asked SME to update the perf and scale page accordingly

[giosif]

Hi Jason,

Thanks for sharing the full slide deck!

However and apologies if I missed it, I still can't find the piece of information I'm looking for - i.e. SXP numbers for hybrid model with 3655 as PAN+MnT and 3655 as shared RADIUS + SXP PSN's.

To be more precise:

• If you look at slide 430 (i.e. ISE 2.3 info), in the last row for the Hybrid deployment you will see 10,000 / 20,000 max SXP bindings.

It is not clear in that slide but, based on the perf and scale page you are referring to, I deduce those are the numbers for shared RADIUS + SXP PSN's vs dedicated RADIUS PSN's + dedicated SXP PSN's.

• In slides 431 (for ISE 2.4) and 432 (for ISE 2.6), you only get one number for the SXP bindings.

Should I read that, for ISE 2.6, the SXP performance for hybrid is the same irrespective of whether you use shared RADIUS + SXP PSN's or dedicated RADIUS PSN's + dedicated SXP PSN's?

But then, if that's the case, the slides are confusing, because they suggest a similar thing for ISE 2.4 as well.

And that's not true, because the perf and scale page specifically mentions 10,000 bindings for the shared RADIUS + SXP PSN's scenario, for ISE 2.4 (while, for dedicated RADIUS PSN's + dedicated SXP PSN's, the page specifies 20,000 bindings).

Also, a few observations / questions for slide 431 (i.e. ISE 2.4 info):

• In last row for Hybrid deployment model, is the number of SXP peers really 220?

The perf and scale page shows only 200 for the same.

• In the first row for the Dedicated deployment model, is the max number of SXP PSN pairs really 4?

The perf and scale page shows a max of only 2 pairs for the same (and the max of 4 pairs is only when using the large MnT virtual appliance).

Also, the max number of SXP peers for the same row is different from the corresponding combination in the perf and scale page (150 / 300 in the slide vs 200 / 400 in the perf and scale page).

Regards,

George

[Jason Kunst]

Pelase send me a direct PM with your email

[Damien Miller]

Glad I'm not the only one that has to think about SXP scaling limits. Sadly, they are usually too restrictive except in specific use cases where it works well.

At an event last week I was told that besides basic mab/dot1x only environments supporting up to 2mil endpoints, scale of 2.6 is unchanged from 2.4. Still somewhat surprised by that since we now have 3695 nodes available for more than the MNTs. I'm curious to see the performance and scale community page updated as we tend to take that as the single source of truth.