Cisco ISE Node Placement Strategy

This document defines how to place Cisco ISE nodes in hybrid and multi-region environments.

---

1. ISE Node Roles and Constraints

Node	Function	Latency Sensitivity	Placement
PAN	Policy/Admin	Low	Centralized
MnT	Logging	Medium	Centralized or regional
PSN	Auth/Posture	Very High	Regional / Local

---

2. Core Design Principle

PSNs follow users. PAN follows operations.

---

3. Recommended Multi-Region Layout

4. High Availability Reality

Component Failure	Impact
PAN down	Authentication continues
MnT down	Logs delayed
PSN down	Authentication fails

4.1 Therefore

• Minimum 2 PSNs per region

• PSNs in separate failure domains

• NADs configured with multiple PSNs

5. Scale Guidance (Rule of Thumb)

PSN Size	Auth/sec
Small	500–800
Medium	~1500
Large	2500+

• Scale horizontally before vertically

6. Anti-Patterns

• Single PSN per region

• PSN dependent on remote AD

• PSN behind asymmetric routing

• Centralized PSN for global NADs

7. Kerberos and LDAP Dependency

PSNs must align with:

• AD Sites & Services

• DNS locality

• Closest DC selection

7.1 Misalignment Causes

• Kerberos delays

• LDAP timeouts

• Machine authentication instability

8. Key Takeaway

PSN placement defines authentication success. High Availability starts at geography, not at node count.

---