I’ve read all those many times, and unfortunately they are great at helping you to expand ISE but not what feeds it. We have done several things, though, mentioned in those documents since our incent.
Thanks, Joseph B. From: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of "Spurgeon, Charles E" <c.spurg...@austin.utexas.edu> Reply-To: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Date: Tuesday, August 3, 2021 at 11:41 AM To: "WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU" <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: Re: [WIRELESS-LAN] can Active Directory backend for ISE be tested before adding all wireless auth? I have no answer for dev testing of AD performance. However, I do have some links to Cisco info on ISE scaling and deployment that I saved for future ref. Here they are in case they may be of use: 1. “2019 How Cisco Deployed ISE” https://www.ciscolive.com/global/on-demand-library.html?search=dgtl-brkcoc%20ise&search=dgtl-brkcoc+ise#/session/1573153539632001Je9Y 2. 2018 – “Designing ISE for Scale and High Availability” https://www.ciscolive.com/global/on-demand-library.html?search=dgtl-brkcoc%20ise&search=dgtl-brkcoc+ise#/session/1500302030233001WuLd 3. “ISE Peformance and Scale” community doc with current updates: https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148 FWIW, I recall hearing somewhere (probably a CiscoLive Online preso) that the ISE-AD config on the Cisco enterprise network used multiple secondary AD servers behind a load balancer (IIRC) to avoid direct connections between ISE and primary AD servers since the primary servers could get busy or hung and freeze up ISE (so to speak). That’s second hand info from memory, so you would definitely want to verify that with Cisco. From: The EDUCAUSE Wireless Issues Community Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> On Behalf Of Joseph Bernard Sent: Tuesday, August 3, 2021 9:49 AM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU Subject: [WIRELESS-LAN] can Active Directory backend for ISE be tested before adding all wireless auth? So we are running ISE which is backended by Active Directory. We have been adding sections of campus to wireless authentication of eduroam and things seemed fine with no issues that we could see. When we finally added the last bit of our environment on Friday, this were going great but then Monday happened and all hell broke loose and authentication went in the toilet. It seemed that ISE couldn’t get answers from AD fast enough and switched to our DR site which made things WAY worse and we had to move all our stuff back to our previous platform. Since that incident, we have tweaked all the settings we can find from minimizing DNS lookups to hiding the DR site from ISE. AD is kind of a black box, so there is only so much we see or find documentation for. My question is, is there a way to test if our AD backend if strong enough to handle our campus of 20,000 wireless devices moving around during a class change without putting it in production first and crossing our fingers? Thanks, Joseph Bernard This message is from an external sender. Learn more about why this matters.<https://ut.service-now.com/sp?id=kb_article&number=KB0011401> ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community ********** Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the person who sent the message, copy and paste their email address and forward the email reply. Additional participation and subscription information can be found at https://www.educause.edu/community
