Cluster ISE

[Flavio Miranda]

 Hi guys,

  I am about to deploy a Cluster of two ISE and I am in doubt with Replication.  I have seen in documentation that is it necessary an physical  connection between two ISEs exclusively for Replication. Therefore, it is not clear to me how to perform that. I mean, with this special connection, we must use 4 interfaces and is it necessary that Addressing stay in the same subnet? During the software instalation, is there  a step where I need to point to which interfaces is gonna be used as Replication ?

thanks in advanced!

[nspasov]

Hello-

I would be interested to see the documentation that is advising on a direct link between the ISE nodes. :) That is completely incorrect. The ISE nodes can either be layer 2 or even layer 3 adjacent and still be part of the same deployment/cluster. The nodes must be layer 2 adjacent if you want to place them in a "Node Group" and behind a load balancer. Otherwise what is more important is the bandwidth availability and the round trip delay between the nodes. I believe the currently supported, maximum round trip delay is 150ms.

Hope this helps!

Thank you for rating helpful posts! 

[Flavio Miranda]

  Hi Neno,

    I may misunderstading  Cisco documentation related to ISE deployment. 

http://www.cisco.com/c/en/us/td/docs/security/ise/1-1-1/installation_guide/ise_install_guide.html

  In this Guide, we can see a connection between nodes. I thought this is a physical connection.

 Thanks for the clarification.

[nspasov · Accepted solution]

So, you can have a direct connection when running iPEP nodes (Inline Posture Nodes) which is done for redundancy and not for replication. However, my guess is that you were not talking about iPEP but just standard ISE nodes.