How to design 3 Nodes ISE?

[ccie14007]

We have 3 ISE nodes license, Want to use 2 in Primary DC, with HA. and then use the 3rd one in the DR.

IN Primary DC,  1 is Primary for Admin, Policy and Monitor.

                         2 is Secondary for Admin, Policy and Monitor

Then how to do with the 3rd one in DR?

thanks

[Rob Ingram]

Hi,
How many users/devices will it be supporting? What services - wired, wireless 802.1x? Guest portals? BYOD?.

3 is an awkward number. How about this:

1 - Primary PAN and MNT
2 - Secondary PAN and MNT + PSN
3 - PSN

this leaves the first ISE node dedicated mgmt and provides redundancy for all personas.

HTH

[marce1000]

 -  By not using such a model , use standard deploymens; 2 admin + monitor , +2 PSN = 4!

M.

[ajc]

My 2 cents.

-The ISE radius or tacacs servers for authentication are the ones running PSN persona not PAN/MNT (admin nodes).

-You should NOT combine multiple personas into the same appliance or VM. But if you have resources constrains then, you should ONLY have 1 primary PAN/MNT, 1 Secondary PAN/MNT and 1 PSN. But still, 1 PSN is not enough because you need redundancy for authentication.

-Running 3495 servers + 2 personas is NOT a good combination, I have seen performance issues so it is much better to run at least 3595.

-At the end, you need minimum 4 appliances or VM's.

[Michael Bartholomæussen]

I've made this topology of our new ISE deployment. I'll be happy to receive any comments or suggestions for better planning, since I've properly missed something. The PSN in the top is deployed, IF the redundant links towards the DC's i disconnected.

[paul46]

Primary PAN+MnT and Secondary PAN+MnT with 3 x PSNs looks good

I would put all three PSNs in a nodegroup to provide redudancy

happy to receive feedback on my thoughts