Cisco ISE Deployment

OBINNA EMESORONYE · ‎02-13-2018

Dear All, I have a a question regarding ISE deployment.

Is it possible to have in the same network the following features all enabled;

1.RADIUS AAA, including 802.1x, MAC Authentication Bypass Done

2.   Web authentication (local, central, device registration)

3.   MACsec

4.   SSO

5.   Guest portal and sponsor services

6.   Representational state transfer (monitoring) APIs

7.   External RESTful services (CRUD)-capable APIs

8.   Security group tagging
9.   PassiveID (Cisco Subscribers)

10.   Passive ID (Non-Cisco Subscribers)

11.   Profiling

12.   Profiler feed service

13.   Device registration (My Devices portal) and provisioning for Bring Your Own Device (BYOD)

14.   Context sharing pxGrid

15.   Endpoint Protection Services

16.   TrustSec – ACI Integration

17.   Rapid Threat Containment (RTC) (using ANC and pxGrid)

18.   Posture (endpoint compliance and remediation)

19.   Enterprise Mobility Management and Mobile Device Management (EMM and MDM) integration

20.   Threat Centric NAC

21.   Wired access control

22.   Device Administration (TACACS+)

Or are some of these feature mutually exclusive?

Thanks.

Mohammed al Baqari · ‎02-13-2018

All these features are supported in ISE as you know. The question do you
need all of them at the same time.

For example due you need PxGrid while you are using REST APIs. Similarly,
do you need ACI while you are using REST API or vice versa.

Also, keep in mind that the more services you put in the node, the bigger
the size and higher the risk of bugs. If you need all of them, then you
need to start thinking about building nodes with specific roles which is
cisco best practice in large deployments.

OBINNA EMESORONYE · ‎02-13-2018

Thanks for your prompt response Mohammed and for bringing to mine best practice of having a multi-node setup which makes a lot of sense.

I am particularly interested in the combination of MACSec, SGT and Posture assessment for the same users. Are they all possible for the same user or mutually exclusive?

Regards,