Hardware and Virtual Appliance Requirements for Cisco ISE
Cisco Identity Services Engine (Cisco ISE) can be installed on Cisco Secure Network Server (SNS) hardware or virtual appliances. To achieve performance and scalability comparable to the Cisco ISE hardware appliance, the virtual machine should be allocated system resources equivalent to the Cisco SNS hardware appliances. This section lists the hardware, software, and virtual machine requirements required to install Cisco ISE.
Note |
For Cisco SNS 3600 series appliance support (SNS-3615-K9, SNS-3655-K9, and SNS-3695-K9), you must use only the new ISO file (ise-2.4.0.357.SPA.x86_64_SNS-36x5_APPLIANCE_ONLY.iso). Cisco ISE 2.4 Patch 9 or above must be applied after installation. We recommend that you do not use this ISO file for SNS 3500 series appliance, VMware, KVM, or Hyper-V installation. |
Note |
Harden your virtual environment and ensure that all the security updates are up-to-date. Cisco is not liable for any security issues found in hypervisors. |
Note |
Cisco ISE does not support VM snapshots for backing up ISE data on any of the virtual environments (VMware, Linux KVM, Microsoft Hyper-V, and Nutanix AHV) because a VM snapshot saves the status of a VM at a given point in time. In a multi-node Cisco ISE deployment, data in all the nodes are continuously synchronized with current database information. Restoring a snapshot might cause database replication and synchronization issues. We recommend that you use the backup functionality included in Cisco ISE for archival and restoration of data. Using snapshots to back up ISE data results in stopping Cisco ISE services. A reboot is required to bring up the ISE node. |
Caution |
If the Snapshot feature is enabled on the VM, it might corrupt the VM configuration. If this issue occurs, you might have to reimage the VM and disable VM snapshot. |
Cisco Secured Network Server Hardware Appliances
For Cisco Secured Network Server (SNS) hardware appliance specifications, see "Table 1, Product Specifications" in the Cisco Secure Network Server Data Sheet.
For Cisco SNS 3500 series appliances, see Cisco SNS-3500 Series Appliance Hardware Installation Guide.
For Cisco SNS 3600 series appliances, see Cisco SNS-3600 Series Appliance Hardware Installation Guide.
VMware Virtual Machine Requirements for Cisco ISE
Cisco ISE supports the following VMware servers and clients:
-
VMware Version 8 (default) for ESXi 5.x (5.1 U2 minimum)
Note
If you are installing Cisco ISE on an ESXi 5.x server, to support RHEL 7 as the Guest OS, update the VMware hardware version to 9 or later. RHEL 7 is supported with VMware hardware version 9 and later.
-
VMware version 11 (default) for ESXi 6.x
Cisco ISE supports the VMware cold migration feature that allows you to migrate virtual machine (VM) instances (running any persona) between hosts. For the cold migration feature to be functional, the following condition must be met:
-
Cisco ISE must be shutdown and powered off: Cisco ISE does not allow to stop or pause the database operations during migration. This might lead to data corruption issues. Hence, ensure that Cisco ISE is not running and active during the migration.
Note
-
You must use the application stop command before using the halt command or powering off the VM to prevent database corruption issues.
-
Cisco ISE VM does not support hot migration (vMotion).
-
Refer to your VMware documentation for more information on vMotion requirements.
Cisco ISE offers the following OVA templates that you can use to install and deploy Cisco ISE on virtual machines (VMs):
-
ISE-2.4.0.xxx-virtual-Eval.ova
-
ISE-2.4.0.xxx-virtual-SNS3515-Small-200GBHD-16GBRAM-12CPU.ova
-
ISE-2.4.0.xxx-virtual-SNS3515-Small-600GBHD-16GBRAM-12CPU.ova
-
ISE-2.4.0.xxx-virtual-SNS3595-Medium-200GBHD-64GBRAM-16CPU.ova
-
ISE-2.4.0.xxx-virtual-SNS3595-Medium-1200GBHD-64GBRAM-16CPU.ova
-
ISE-2.4.0.xxx-virtual-SNS3595-Large-1200GBHD-256GBRAM-16CPU.ova
The 200 GB OVA templates are sufficient for Cisco ISE nodes that serve as dedicated Policy Service or pxGrid nodes.
The 600 GB and 1.2 TB OVA templates are recommended to meet the minimum requirements for ISE nodes that run the Administration or Monitoring persona.
If you need to customize the disk size, CPU, or memory allocation, you can manually deploy Cisco ISE using the standard .iso image. However, it is important that you ensure the minimum requirements and resource reservations specified in this document are met. The OVA templates simplify ISE virtual appliance deployment by automatically applying the minimum resources required for each platform.
The OVA template reservations for the base SNS platforms are provided in the table below.
OVA Template |
Memory |
CPU |
---|---|---|
Virtual Eval OVA |
16 GB RAM |
2300 MHz (no reservation) |
Virtual SNS-3515 OVA (Small) |
16 GB RAM |
12 GHz |
Virtual SNS-3595 OVA (Medium) |
64 GB RAM |
16 GHz |
Virtual SNS-3595 OVA (Large) The large node is only for use as a performance-enhanced MnT node. You cannot use the Large VM as a PAN, PSN, or pxGrid node. |
256 GB RAM |
16+ GHz |
We strongly recommend that you reserve CPU and memory resources to match the resource allocation. Failure to do so may significantly impact ISE performance and stability.
For information about the product specifications for Cisco SNS appliance, see Cisco Secure Network Server Data Sheet.
The following table lists the VMware virtual machine requirements.
Requirement Type |
Specifications |
||
---|---|---|---|
CPU |
See OVA Template Reservations for CPU Reservations. |
||
Memory |
See OVA Template Reservations for Memory Reservations. |
||
Hard Disks |
|
||
Storage and File System |
The storage system for the Cisco ISE virtual appliance requires a minimum write performance of 50 MB per second and a read performance of 300 MB per second. Deploy a storage system that meets these performance criteria and is supported by VMware server. You can use the show tech-support command to view the read and write performance metrics. We recommend the VMFS file system because it is most extensively tested, but other file systems, transports, and media can also be deployed provided they meet the above requirements. |
||
Disk Controller |
Paravirtual (default for RHEL 7 64-bit) or LSI Logic Parallel For best performance and redundancy, a caching RAID controller is recommended. Controller options such as RAID 10 (also known as 1+0) can offer higher overall write performance and redundancy than RAID 5, for example. Additionally, battery-backed controller cache can significantly improve write operations.
|
||
NIC |
1 NIC interface required (two or more NICs are recommended; six NICs are supported). Cisco ISE supports E1000 and VMXNET3 adapters.
|
||
VMware Virtual Hardware Version/Hypervisor |
VMware Virtual Machine Hardware Version 8 or higher on ESXi 5.x (5.1 U2 minimum) and 6.x.
|
Linux KVM Requirements for Cisco ISE
Requirement Type |
Minimum Requirements |
||
---|---|---|---|
CPU |
See OVA Template Reservations for CPU Reservations. |
||
Memory |
See OVA Template Reservations for Memory Reservations. |
||
Hard disks |
|
||
KVM Disk Device |
Disk bus - virtio, cache mode - none, I/O mode - native Use preallocated RAW storage format. |
||
NIC |
1 NIC interface required (two or more NICs are recommended; six NICs are supported). Cisco ISE supports VirtIO drivers. We recommend VirtIO drivers for better performance. |
||
Hypervisor |
KVM on RHEL 7.0 |
Microsoft Hyper-V Requirements for Cisco ISE
Requirement Type |
Minimum Requirements |
||
---|---|---|---|
CPU |
See OVA Template Reservations for CPU Reservations. |
||
Memory |
See OVA Template Reservations for Memory Reservations. |
||
Hard disks |
|
||
NIC |
1 NIC interface required (two or more NICs are recommended; six NICs are supported). |
||
Hypervisor |
Hyper-V (Microsoft) |