Sizing ISE: Appliance SKUs, VM Resource Profiles, Session Scale & Licence Tiers

Overview

ISE sizing usually goes wrong in the same direction: a VM size is chosen first, from whatever the hypervisor had free, and the endpoint count is discovered later. The mistakes don’t cost the same. An undersized VM can be given more CPU and memory later. A disk that turns out too small can only be grown by reinstalling. And an oversized VM can’t be shrunk without reimaging.

This lesson sizes the other way round: sessions first, then the deployment shape, then the platform, then the licence. It closes on the course lab’s own nodes, which are deliberately far below every production profile.

Terminology: The Unit Is a Session

Cisco’s capacity figures are counts of concurrent active sessions, and the definition is simple: each endpoint with a unique MAC address counts as one session. A laptop on wired and wireless at once is normally two, because each interface has its own MAC address.

Two ceilings apply at the same time:

• The deployment ceiling — set by the nodes that run Administration and Monitoring, and by the shape
• The per-PSN ceiling — how many sessions one Policy Service node carries

A design has to fit under both. Adding PSNs adds aggregate Policy Service capacity, but changes neither the per-PSN ceiling nor the deployment ceiling.

Scale & Limits: The SNS Appliances

The Cisco Secure Network Server (SNS) families covered by ISE 3.5’s guidance are the 3700 series, supported from ISE 3.1 patch 6 and 3.2 patch 2, and the 3800 series, based on the UCS C225 M8, supported from ISE 3.3 patch 7. Within each family, the last two digits read small, medium, large:

Enlarge figure: Three SNS appliance tiers drawn the same way — small (3715/3815), medium (3755/3855), large (3795/3895) — each with its CPU, memory and concurrent-session ceilings as a dedicated PSN and in a small, medium and large deployment

The session ceilings from Cisco’s Performance and Scalability Guide, Tables 3 and 4:

Three things the table teaches, all from the same guide:

1. A shared PSN is rated at half a dedicated one. Taking Administration and Monitoring off a node doubles its rated concurrent sessions — the table’s capacity, not a promise of twice the authentication rate.
2. The largest appliance buys nothing as a PSN. Cisco notes that the 3795/3895 add RAM and disk speed that suit PAN and MnT, and “provide no additional value when used only as a dedicated PSN”.
3. The small appliances can’t anchor a large deployment, and Cisco says the 32 GB ones, as the PAN or MnT of a small or medium deployment, should carry only RADIUS or only TACACS+ workloads.

Design Choice: A VM Is an Appliance With Reservations

Cisco’s rule for virtual ISE is that a VM should have the same resources as the SNS appliance whose performance you expect. Three details turn that into a build:

• vCPU is twice the physical cores, because of hyperthreading — the SNS 3715 profile is 24 vCPUs
• CPU and memory are reserved wherever the platform supports reservations, with the limits set to Unlimited — “not reserving enough resources can significantly affect ISE performance and stability”
• Resources only go up. Moving up to a larger supported profile later needs no reimage; decreasing CPU or RAM means reimaging

Enlarge figure: Turning an SNS 3715 into a VM: 12 physical cores become 24 vCPUs with a 24 GHz CPU reservation, 32 GB of memory is reserved in full, limits stay unlimited, and the disk is chosen by persona — 300 GB for a dedicated PSN, 600 GB or more with Administration or Monitoring

Cisco’s OVA templates set the vCPU count and memory, and each carries a matching reservation — the Small (SNS 3715) template, for instance, reserves 24 GHz of CPU and 32 GB of memory. From Cisco’s hardware requirements page:

The Extra Small profile can run only the Policy Service persona.

On VMware, the platform requirements that catch people are:

The same rule — match an appliance, reserve what you allocate — applies on the other hypervisors ISE 3.5 supports:

Below the small appliances, Cisco’s Performance and Scalability Guide also rates an Extra Small 8 vCPU / 32 GB VM in two forms: PSNLite, a dedicated PSN on 300 GB rated at 12,000 sessions, and ISELite, a standalone node on 600 GB rated at 1,000 sessions (from ISE 3.4). Neither runs on an SNS appliance.

Scale & Limits: Disk by Persona

Disk is sized by what the node runs, not by the appliance:

The reason is the log store: on any node with the Monitoring persona, 60 percent of the disk is set aside for logs. Cisco’s disk space guidelines put the rule of thumb at about 1 GB of logs a day for 25,000 endpoints. Two more rules are easy to miss: ISE must sit on a single disk, and growing that disk after installation means a fresh install. Disks of 2 TB or more also need the VM’s firmware set to EFI.

Design Choice: What the Licence Decides

Hardware sets how many sessions a node can carry. The licence sets which features those sessions can use, and how many endpoints may use them. ISE 3.5 uses smart licences only — the reservation options on the Licensing page are forms of smart licensing — and the old Base, Plus and Apex licences are gone.

Enlarge figure: Licence tiers as nested boxes: Premier (posture, MDM compliance) contains Advantage (profiling, BYOD with the built-in CA, TrustSec, pxGrid) which contains Essentials (RADIUS AAA, guest, Passive ID, APIs); Device Administration counted per TACACS+ PSN and VM counted per virtual node sit outside the tiers as separate counts

The tiers are nested: each includes the one below it. ISE 3.5 also starts counting some Advantage features — pxGrid, pxGrid Direct, profiling and TrustSec — by the number of active endpoints using each; going over produces a License Over Consumption message but no enforcement.

Design Choice: A Worked Example

A campus that peaks at 30,000 concurrent sessions in one data centre, needing redundancy, profiling and TACACS+ for its switches, sized against the ceilings in the Performance and Scalability Guide:

1. Shape. 30,000 sessions is under the small ceiling of 50,000, so two nodes running every persona — as long as the platform allows it.
2. Platform. An SNS 3715 pair tops out at 25,000 in the small shape, so it’s too small. SNS 3755 or 3855, or VMs matching them, give 50,000 small.
3. PSN headroom. Each node is a shared PSN rated at 50,000 on those platforms (Table 4), so one node can carry the whole load when the other fails.
4. Disk. Both nodes run Administration and Monitoring: 600 GB minimum each, more if log retention needs it.
5. Licences. Advantage for profiling, covering the endpoints that use it; Device Administration for each PSN that runs TACACS+; and a VM licence per node if they’re virtual.

If the campus grows past 50,000 — the small ceiling in the guide — the next step is the medium shape: the same pair as PAN/MnT, with dedicated PSNs added beside them.

🔬 See It in the Lab: The Lab’s Own Nodes

This reads ISE-01 (10.82.22.161) as it runs in the course lab. Nothing here changes configuration.

Step 1 — what platform does ISE think it is on? From WS-ADMIN-01, SSH to ISE-01 and run show inventory. (The serial-number line is left out below.)

ise-01/admin#show inventory
inventory 
          NAME: "ISE-VM-K9    chassis", DESCR: "ISE-VM-K9     chassis" 
          Manufacturer: VMware, Inc. 
          Product Name: VMware Virtual Platform 
          Total RAM Memory: 16139444 kB
          CPU Core Count: 4
          CPU 0: Model Info: Intel(R) Xeon(R) Gold 6152 CPU @ 2.10GHz
          CPU 1: Model Info: Intel(R) Xeon(R) Gold 6152 CPU @ 2.10GHz
          CPU 2: Model Info: Intel(R) Xeon(R) Gold 6152 CPU @ 2.10GHz
          CPU 3: Model Info: Intel(R) Xeon(R) Gold 6152 CPU @ 2.10GHz
          Hard Disk Count(*): 1
          Disk 0: Device Name: /dev/sda:
          Disk 0: Capacity: 300GiB
          NIC Count: 1
          NIC 0: Device Name: eth0:
          NIC 0: HW Address: 00:0c:29:1c:18:8e
          NIC 0: Driver Descr: Intel(R) PRO/1000 Network Driver
          (*) Hard Disk Count may be Logical.

Read it against the tables above. The product ID is ISE-VM-K9 — a virtual node, which in production needs a VM licence. Four vCPUs and 16 GB is half the Extra Small profile, and a 300 GB disk is below the 600 GB minimum for a node running Administration and Monitoring. This is a lab-scale node, and it would not meet Cisco’s production minimums for any persona.

Step 2 — how much of it is in use? Run show memory:

ise-01/admin#show memory
memory total memory:       16139444 kB
       free memory:          330268 kB
       cached:          2638200 kB
       swap-cached:       101020 kB
       output of free command:
                     total        used        free      shared  buff/cache   available
       Mem:       16139444    12539412      328332     1669116     3271700     1568568
       Swap:       9241312      451900     8789412

With the deployment idle, 12.5 of 16 GB is already used, about 1.5 GB is reported available, and 452 MB of swap is occupied. That is why nothing measured on this lab — authentication rates, report times — is a statement about ISE’s real performance.

Step 3 — the disk check at install. You won’t repeat this one; it happened when ISE-01 was built. The setup program tests storage before it installs anything, and ISE-01’s console showed:

Testing VM disk I/O performance...
Average I/O bandwidth writing to disk device: 475 MB/second 
Average I/O bandwidth reading from disk device: 679 MB/second 
I/O bandwidth performance within supported guidelines

Both are above Cisco’s floor of 50 MB/s write and 300 MB/s read, which is why setup carried on.

Step 4 — the licence. In the GUI, open Administration › System › Licensing.

The banner reads Evaluation Mode 89 Days, and both PANs identify as ISE-VM-K9. No licence is registered: the lab runs on the evaluation, so every feature works and the evaluation supports up to 100 endpoints.

🎥 [Video: sizing backwards from a VM size; the session as the unit and the two ceilings; the SNS 3700/3800 tiers as three repeated boxes; turning an appliance into a VM with reservations and a persona-sized disk; what the licence decides; the lab’s own node read with show inventory and show memory. Matches video.script_outline. Runtime: ~9 minutes]