ISE Nodes
Platform options : Physical | Virtual
Primary components: Cisco ISE licenses, Appliances, and Services.
ISE consists of 3 different personas: PSN, PAN and MnT:
Policy Service Node (PSN) is the workhorse of ISE providing network access, posture, BYOD, guest access, client provisioning, and profiling services. Policy Services Node provides AAA services including RADIUS services, TACACS services.
Policy Administration Node (PAN) is used for managing policies, users/groups, network devices etc.
Monitoring Node (MnT) is used as the log collector and stores log messages from all the Administration and Policy Service nodes in a network.
In case, we have a deployment where we will use 2 x ISE (all personas PAN/MnT/PSN on the same node), the 2nd ISE will be used for HA(high availability). The PAN and MnT personas will be in Active/Standby mode, but PSNs always work in active mode.
Since PSN provides network access we will point NADs (Network Access Devices - switches, WLCs) to both PSNs. If we want to use the 2nd PSN only when the 1st PSN fails, we will first configure the 1st PSN and then add the 2nd PSN as RADIUS servers to NADs. RADIUS servers are used in a top-down fashion. This way our NADs will use only the 1st PSN as their primary RADIUS server and if/when it fails, the NADs will switch to the 2nd ISE node.
We should buy 2 x ISE VM licenses (2 x R-ISE-VMC-K9=), but buy only 1 set of ISE licenses (Essentials, Advantage or Premier). ISE licensing (Essentials, Advantage, and Premier) is based on the number of concurrent sessions. It means that if we have 2000 users, but only 1000 are connecting at the same time, we should order 1000 licenses OR if we have 2000 users and they have PC + IP phone and all of them are connected at the same time, we should buy 4000 licenses (2000 users x 2 PC + IP phone). For more info about ISE licenses, please, refer to Table 1:
Tutorial recommendation for a Cisco ISE Project
ISE Webinars | First week of every month!
ISE YouTube Channel | ISE Webinar archive and more!
ISE Training | YouTube, Cisco Live, and more!
Radius for Network Authentication
Methods supported on ISE for Authentication
Radius Testing Tools
NTRadping for Windows
EAPTest for Mac
RadiusSimulator.jar runs on Java
eapol_test for Linux