Architecture and Deployment · Topic 2 of 3
Deployment Options and Sizing
Compare standalone, small distributed and large dedicated ISE deployments, plus appliance and virtual machine form factors and the sizing rules.
- 5 min
- A standalone node runs all personas and offers no redundancy.
- A two node deployment gives node redundancy, with manual promotion of the secondary PAN.
- Large deployments use dedicated PAN, MnT and PSN nodes, and scale by adding PSNs.
What it is
A deployment option is the way you spread ISE personas across nodes to meet your size and resilience needs.
You also choose the form factor of each node. It can be a Cisco Secure Network Server appliance, a virtual machine, or an instance in a public cloud.
How it works
You pick the smallest design that gives the resilience and scale you need, then size each node to match.
Deployment models
| Model | Layout | Typical use |
|---|---|---|
| Standalone | One node runs all personas | Lab, proof of concept, very small site |
| Small distributed (two nodes) | Primary and secondary nodes, each with PAN, MnT and PSN | Small production with node redundancy |
| Medium distributed | Two admin and monitoring nodes plus a few PSNs | Mid size production |
| Large dedicated | Separate PAN, MnT and PSN nodes | Large scale, many sessions |
A standalone node has no redundancy. If it fails, authentication stops. The two node model keeps service going, because the other node can answer requests, although you promote the secondary admin node by hand.
In a larger design the PSNs are scaled out. The PAN and MnT nodes are kept as a redundant pair, and PSNs are added as the session count grows. A large deployment can have many PSNs, up to a published maximum that depends on the release.
Where to place PSNs
Put PSNs close to the network devices and users they serve. Network devices list several RADIUS servers, so authentication still works if one PSN is down.
You can also put a load balancer in front of a set of PSNs. The devices then point at one virtual address. The balancer has to keep a client on one PSN for the whole flow, and it should handle RADIUS and the web portals.
Switch(config)# radius server ISE-PSN1
Switch(config-radius-server)# address ipv4 10.1.1.11 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key SECRET
Switch(config-radius-server)# exit
Switch(config)# radius server ISE-PSN2
Switch(config-radius-server)# address ipv4 10.1.1.12 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key SECRET
Switch(config-radius-server)# exit
Switch(config)# aaa group server radius ISE-GRP
Switch(config-sg-radius)# server name ISE-PSN1
Switch(config-sg-radius)# server name ISE-PSN2This is IOS XE. The device tries the first PSN and moves on to the second if the first does not answer.
Form factors
| Form factor | Notes |
|---|---|
| Physical appliance | Cisco Secure Network Server models. Larger models handle more sessions. |
| Virtual machine | Runs on a hypervisor such as VMware ESXi, KVM or Microsoft Hyper-V. Cisco supplies templates and sizing guidance. |
| Public cloud | Supported on major cloud platforms in recent ISE releases. Check the release notes for the current list. |
Sizing a node
The performance of a node depends on its CPU, memory and disk. A larger appliance or a bigger virtual machine can authenticate more endpoints and hold more sessions.
For virtual machines, a few rules decide whether the node performs as designed:
- Reserve the resources. Reserve the CPU and memory you assign, so the hypervisor does not share them with other guests.
- Provision the disk fully. Thick provisioning is recommended over thin provisioning.
- Use fast storage. Disk latency matters most for the Monitoring node, because it writes every log.
- Match the published profile. Use the CPU, memory and disk that Cisco lists for the persona you run.
A node that runs several personas needs more than a node with a single persona. A dedicated MnT needs a lot of disk, since it stores the logs. A dedicated PSN needs mostly CPU and memory.
Cisco publishes scaling tables that list the maximum number of endpoints per deployment model and platform. Use them, not a guess, when you plan capacity. The numbers differ between releases.
Ports and reachability
Nodes need to reach each other, and network devices need to reach the PSNs. The main service ports are RADIUS authentication and accounting, TACACS+, the portals, and CoA back to the device.
| Service | Port |
|---|---|
| RADIUS authentication | UDP 1812 |
| RADIUS accounting | UDP 1813 |
| TACACS+ | TCP 49 |
| CoA to network devices | UDP 1700 |
| Guest and sponsor portals | TCP 8443 and 8445 |
Size the deployment for the failure case. If one PSN fails, the others must carry its sessions without running out of capacity.
What to remember for the exam
Six facts cover this topic.
- A standalone node runs all personas and offers no redundancy.
- A two node deployment gives node redundancy, with manual promotion of the secondary PAN.
- Large deployments use dedicated PAN, MnT and PSN nodes, and scale by adding PSNs.
- Node form factors are physical appliance, virtual machine and public cloud.
- Reserve CPU and memory for virtual machines, and use thick provisioning.
- RADIUS uses UDP 1812 and 1813, and TACACS+ uses TCP 49.
A virtual node with oversubscribed CPU or memory will perform poorly under load, even if it passes the install checks. Reserve the resources.
Common mistakes
These four mistakes are common.
Choosing standalone for production. One node is a single point of failure.
Thin provisioning the disk. It can cause slow writes and unpredictable performance.
Putting all personas on every node in a large design. Dedicated nodes scale better and are easier to size.
Planning capacity for normal operation only. Plan for the loss of a PSN as well.
Check yourself
Work through these three questions.
Why is a standalone node not suitable for a production network?
It has no redundancy, so a failure stops authentication.
Which resources should you reserve for an ISE virtual machine?
Reserve the CPU and memory you assign, and provision the disk fully rather than thin.
How does a large ISE deployment scale as the session count grows?
It adds more Policy Service Nodes, while keeping the PAN and MnT nodes as a redundant pair.
Topic 2 of 3 in Architecture and Deployment
Test yourself on Architecture and Deployment
The full Cisco CCNP 300-715 SISE question bank has 852 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.