SD-Access Multi-Site Deployment - ISE PSN Question

[newtonr]

In an SD-Access multi-site deployment with 10G metro-ethernet between sites can a shared PSN pair be used across all sites (hosted at DC) or do we need to dedicate a PSN pair per fabric site? All documents seem to point to dedicated PSN per fabric site, like WLC), but if the site is relatively small and two or more sites can easily be accommodated by a suitably-sized PSN, then is this supported? associating same PSN to multiple sites?

Rob

[Scott Hodgdon · Accepted solution]

newtonr,

Each site should have at least 2 PSNs for resilience, but the PSNs do not have to be local to the site and multiple sites can share PSNs. As long as your PSNs can handle all required operations from all sites, you could certainly have just a pair of PSNs (maybe one in each DC) that all sites can use.

You could also point to a load balancer VIP, behind which could sit multiple PSNs. The advantage to a VIP, in my opinion, is that it is easier to add / remove / change PSNs without needing to change the configuration on a site. For example, if you point to a VIP and need to add a third PSN, then all you need to do is add it to the load balancer policies instead of adding it to each site.

When we say that we need a PSN per site, what we are really saying is that we need a PSN configuration per site, but that the PSN can be remote.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

[newtonr]

Thanks for quick response Scott. That's what I thought was the case but just needed clarification. 

Rob