Cluster ISE on premises node with a second node in Azure

[Yacine BS]

Hello,

We have a bare metal ISE Server on premises. We have migrated many of our services over Azure cloud and since there is only one ISE node, we want to have a cluster with a node in the cloud. Is it possible and what are the limitations for this cluster?

Thanks,

[balaji.bandi]

Most use case Cisco suggest below :

- The location of AAA clients is important. You should locate the Cisco ISE nodes as close as possible to the AAA clients to reduce network latency effects and the potential for loss of access that is caused by WAN failures.

- Latency guidance is not a “fall off the cliff” number, but a guard rail based on what QA has tested.
- Not all customers have issues with > 300ms while others may have issues with <100ms latency due to overall ISE design and deployment.
- Profiler config is primary determinant in replication requirements between PSNs and PAN which translates to latency.
- When providing guidance, max 300ms roundtrip latency is the correct response from SEs for their customers to design against.

Look at Azure deployment considerations :

https://www.cisco.com/c/en/us/td/docs/security/ise/ISE_on_Cloud/b_ISEonCloud/m_ISEonAzureServices.html

Other factors you need to check :  LDAP, DNS other stuff.

[Yacine BS]

Thank you for your response,

However, since the points to consider are not a priority for this deployment, is it possible to have an ISE cluster between a bare metal and Azure VM.

Thanks

[ahollifield · Accepted solution]

Sure, this is certainly possible.  This is the same as combining traditional on-premise hypervisors (VM-Ware ESXi) with SNS appliances.  

[balaji.bandi · Accepted solution]

I mean - yes possible with above consideration

[Yacine BS]

Thank you for your help!