cisco ISE

Platform options : Physical | Virtual

Primary components:  Cisco ISE licenses, Appliances, and Services.

Can we have ISE HA in Active - Stand By / Will it be Active - Active only?

ISE consists of 3 different personas: PSN, PAN and MnT:

• Policy Service Node (PSN) is the workhorse of ISE providing network access, posture, BYOD, guest access, client provisioning, and profiling services. Policy Services Node provides AAA services including RADIUS services, TACACS services.

• Policy Administration Node (PAN) is used for managing policies, users/groups, network devices etc. 

• Monitoring Node (MnT) is used as the log collector and stores log messages from all the Administration and Policy Service nodes in a network. 

In case, we have a deployment where we will use 2 x ISE (all personas PAN/MnT/PSN on the same node), the 2nd ISE will be used for HA(high availability). The PAN and MnT personas will be in Active/Standby mode, but PSNs always work in active mode. 

Since PSN provides network access we will point NADs (Network Access Devices - switches, WLCs) to both PSNs. If we want to use the 2nd PSN only when the 1st PSN fails, we will first configure the 1st PSN and then add the 2nd PSN as RADIUS servers to NADs. RADIUS servers are used in a top-down fashion. This way our NADs will use only the 1st PSN as their primary RADIUS server and if/when it fails, the NADs will switch to the 2nd ISE node.

Do we need to purchase License for both ISE VM in the scenario of HA?

We should buy 2 x ISE VM licenses (2 x R-ISE-VMC-K9=), but buy only 1 set of ISE licenses (Essentials, Advantage or Premier). ISE licensing (Essentials, Advantage, and Premier) is based on the number of concurrent sessions. It means that if we have 2000 users, but only 1000 are connecting at the same time, we should order 1000 licenses OR if we have 2000 users and they have PC + IP phone and all of them are connected at the same time, we should buy 4000 licenses (2000 users x 2 PC + IP phone). For more info about ISE licenses, please, refer to Table 1:

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/guide-c07-656177.html

LEARN

Radius Testing Tools

• NTRadping for Windows

• EAPTest for Mac

• RadiusSimulator.jar runs on Java

• eapol_test for Linux