Distributed Deployment - AMFPHP or Zend?

Hi
I want to have a client side Air applications which connects to a wan server (currently setup as linux with apache2, php5 and mysql) . The server side will be uploading/downloading jpeg images from the mysql database and other string information, with the client making the relevant upload/download requests.
Should I be able to have the images in mysql, accessed via php to the client? Should I need anything else? I've noted some people mention amfphp or zend framework? Do I need these things? I'm currently struggling to get the flash framework to be able to connect to the PHPweb service.

Q,
The first place to start is to look at the cucm 10.X SRND. Look in detail at capacity planning and call processing.
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/callpros.html
Each cucm 10.X node can support a total of 10,000 users/devices using the 10,000 OVA template. The cluster can support a total of 40,000 users/devices. I am sure this will meet your present and future needs.
Next you need to look at sizing. The cisco virtualization wiki details what to do in this case..
http://docwiki.cisco.com/wiki/Unified_Communications_in_a_Virtualized_Environment#How_to_Design
Download the sizing tool from here
http://tools.cisco.com/cucst/faces/landing.jsp
Then use the placement tool to determine how you should place your VMs..
You  may want to send your final output to Cisco to verify your design. Virtualization is not so straight forward as bare metal server deployments, so you need to design carefully.
From what you have said, looking at about 20,000 users I would suggest the following
1. 4 cucm subscribers--each deployed with 5,000 users/devices. This setup will allow for one to one backup
2. 2 dedicated tftp/moh servers
3. 1 publisher
That gives you a total of 7 virtual machines. This means that you will need two UCS servers-C series servers
Although the sizing tool suggested 12 VMs with six subscribers.. (this means that you will need three UCS servers-C series)
For SRST, depending on how critical the phone system is you either do the ff
1. Use the voice gateway at the site to support SRST. This obviously is limited to the capacity of the voice gateway at the site
2. Re-use the existing cucm servers and deploy them at the local site just for SRST. This will ensure you can support the whole site in SRST
It is advisable to place your UCS servers in your DC. If you have a single DC, then you place one there and then the other at another site (Hq)

Similar Messages

  • Need suggestion for ISE distributed deployment model in two different data centers along with public certificate for HTTPS

    Hi Experts,
    I am bit confused about ISE distributed deployment model .
    I have two data centers one is DC & other one is as a DR I have  requirement of guest access service implementation using CWA and get public certificate for HTTPS to avoid certificate error on client devices :
    how do i deploy ISE persona for HA in this two data centers
    After reading cisco doc , understood that we can have two PAN ( Primary in DC  & Secondary in DR ) like wise for MnT (Monitoring will be as same as PAN ) however I can have 5 PSN running in secondary i.e. in DR ISE however I have confusion about HA for PSN .. since we have all PSN in secondary , it would not work for HA if it fails
    Can anybody suggest me the best deployment solution for this scenario ?
    Another doubt about public certificate :
     Public Certificate: The ISE domain must be a registered or part of a registered domain name on the Internet. for that I need Domain name being used from customer .
    Please do correct me if I am wrong about certificate understanding :
    since Guest will be the outside users , we can not use certificate from internal CA , we need to get the certificate from service provider and install the same in both the ISE servers
    Can anybody explain the procedure to opt the public certificate for HTTPS from service provider ? And how do i install it in both the ISE servers ?

    Hi there. Let me try answering your questions:
    PSN HA: The PSNs are not configured as "primary" or "secondary" inside your ISE deployment. They are just PSN nodes as far as ISE is concerned. Instead, inside your NADs (In your case WLCs) you can specify which PSN is primary, which one is secondary, etc. You can accomplish this by:
    1. Defining all PSN nodes as AAA radius servers inside the WLC
    2. Then under the SSID > AAA Servers Tab, you can list the AAA servers in the order that you prefer. As a result, the WLC will always use the first server listed until that server fails/gets reloaded, etc. 
    3. As a result, you can have one WLC or SSID prefer PSN server A (located in primary DC) while a second WLC or SSID prefer PSN server B (located in backup DC)
    Last but not the least, you could also place PSNs behind a load balancer and that way the traffic would be equally distributed between multiple PSNs. However, the PSN nodes must be Layer 2 adjacent, which is probably not the case if they are located in two different Data Centers
    Certificates: Yes, you would want to get a public certificate to service the guest portal. Getting a public/well known certificate would ensure that most devices out there would trust the CA that signed your ISE certificate. For instance, VeriSign, GoDaddy, Entrust are some of the ones out there that would work just fine. On the other hand, if you use a certificate that was signed by your internal CA, then things would be fine for your internal endpoints that trust your internal CA but for any outsiders (Guests, contractors, etc) that do not trust and do not know who your internal CA is would get a certificate error when being redirected to the ISE guest portal. This in general is only a "cosmetic" issue and if the users click "continue" and add your CA as a trusted authority, the guest page would load and the session would work. However, most users out there would not feel safe to proceed and you will most likely get a lot of calls to your helpdesk :)
    I hope this helps!
    Thank you for rating helpful posts!

  • ISE NODE NOT REACHABLE when building distributed deployment

    I am trying to build a distributed deployment with the following personas:
    2 policy admin nodes
    2 monitoring nodes
    4 policy service nodes
    This was a project that was partially implemented but never in production. It was in a distributed deployment, but half the nodes were no longer working (http errors or devices weren't reachable or could not sync). I decided to start from scratch. All nodes were:
    -de-registered
    -application was reset to factory defaults on all nodes
    -upgraded all 8 nodes to 1.1.4.218 patch 1
    -installed all new certs and joined all nodes to the domain
    -added to DNS forward and reverse lookup zones
    When I make 1 admin node primary and register the other nodes (secondary admin, monitoring, policy services) the nodes successfully register and show up in the deployment window of the primary; however, all the nodes show as NODE NOT REACHABLE. After registration, I've noticed that the registered nodes are still showing as STANDALONE if I access the GUI. I've tried rebooting them manually after registration and they are still unreachable. I have also tried resetting the database user password from the CLI on both admin nodes and the results are always the same.

    Originally I had added them all at the same time. I thought that maybe I just wasn't waiting long enough for the sync. I waited an entire day and all the nodes were still unreachable. At this point, I've de-registered all the nodes, rebooted all the nodes, converted the primary back to standalone (the remaining nodes never converted from standalone to distributed even when I rebooted them after registering despite a message that they were successfully registered), converted one node back to primary and tried to register just the secondary admin node giving it plenty of time to sync; this node is still not reachable from the primary.
    I've quadruple checked the certificates on all the nodes, these certs were all added on the same day (just last week) and the default self-signed certs were removed.
    I had restored from a backup on the primary so I might just rest the config on that node and try joining the other nodes before I restore again.

  • ISE PSN rebooted and will not rejoin distributed deployment

    Hi,
    A PSN was powered down by accident and I'm trying to register it back to its PAN as part of a distributed deployment but I keep getting the error message "ISE not in Standalone mode".
    I'm not sure how to set the PSN node back to Standalone mode when it's no longer part of the deployment.
    Thanks for any help.
    Barry

    Hi,
    Yes Deregister the PSN from the PAN after deregistration this node become Standalone node.

  • ISE 1.1.1 firewall rules distributed deployment

    My question is in reference to the following link:
    http://www.cisco.com/en/US/docs/security/ise/1.1.1/installation_guide/ise_app_e-ports.html
    Basically I am struggling in some areas to work out my firewall rules for a distributed deployment. The referenced documentation is not entirely clear in my opinion. In some instances it is easy to work out what ports need to be opened eg Admin node TCP 22,80,443 for management from administrator hosts/ranges. In other instances it difficult to work out eg TCP 1521 Database listener and AQ is this for ISE nodes only or for access devices aswell
    My question is whether there is a better document that details these requirements. What rules are meant to be ISE node - ISE node communications and which rules are for access device - ISE, or ISE - access device. One of the rules I am pretty confused about is the PSN CoA ports. SHould the rule be WLC - PSN on 1700 and 3799 or is it the otherway round or unidirectional?
    I am pretty sure that the ports are meant to be ISE-ISE in most instances barring the PSN for Radius and CoA.

    Try this for size.
    In answer to the specific CoA question, I see no need for the WLC to send CoA to PSN, so just PSN to WLC as far as I can see.
    You might be able to cut this list down, and you might have to add to it for any specific requirements.
    From PSN to AD (potentially all AD nodes):
    TCP 389, 3268, 445, 88, 464
    UDP 389, 3268
    From PSN to Monitoring nodes:
    TCP 443
    UDP 20514
    PSN to Admin Nodes (2Way):
    TCP 443, 1521
    ICMP echo and reply (heartbeat)
    WLC to PSN:
    TCP 443, 8443, 80, 8080
    UDP 1645, 1646, 1812, 1813, 1700, 3799, 161, 162, 9993, 67
    PSN to other PSN’s (2 way)
    UDP 30514, 45588, 45990
    Endpoint (Laptop) to PSN (Guest laptops just need to get to external PSN’s, internal users just to internal PSN’s)
    TCP 8443, 8905
    UDP 8905
    Admin/Sponsor to all ISE nodes:
    TCP 22, 80, 443, 8080, 8443
    UDP 161
    PSN access to DNS servers:
    TCP/UDP 53
    PSN access to NTP servers:
    UDP 123

  • Ise distributed deployment upgrade

    My customer has an ISE deployment with 4 nodes: Admin/Monitor Primary and Secondary plus 2 Policy Server. The Admin nodes are VMs, the Policy nodes are 3315 appliances.
    The system was installed almost three years ago with the version 1.1.0 ... It appears the system never had issues so never was patched or upgraded. Why fix something that is working fine?
    Today there was an issue because the certificates expired, so in the review to get the system up and running again, the update issue bring on to the conversation. We like to do an upgrade to the last supported version. So I wonder for some tips and ideas to take care for planning the upgrade.
    I have some doubts:
    Can the 3315 appliance support the release 1.3 without issues?
    I know the upgrade procedure is basically installing a .tar file, but I'm not clear how the process in a distributed deployment should be. I had run upgrades in standalone systems, but never in a distributed deployment. So, I need to upgrade the Primary Admin only and the other nodes would upgrade automatically?
    I would need to upgrade 1.1 to 1.2 first and then 1.2 to 1.3?
    I undertand release 1.1 was in 32 bits, and the version 1.2 and 1.3 are in 64 bits, so I guess the process would take a long time (perhaps a couple of hours), so a maintenance window would need 3 or 4 hours until the full system became stable.
    Can you give me some advice and suggestions to avoid major issues?
    Regards.
    Daniel Escalante.

    Can you give me some advice and suggestions to avoid major issues?
    Documents related to upgarde were given by Venkatesh refer those. Along with that additional information.
    Can the 3315 appliance support the release 1.3 without issues?
    Cisco ISE-3315-K9 (small) 3
    Supports ISE 1.3
    Any
    1x Xeon 2.66-GHz quad-core processor
    4 GB RAM
    2 x 250 GB SATA4 HDD5
    4x 1 GB NIC6
    I know the upgrade procedure is basically installing a .tar file, but I'm not clear how the process in a distributed deployment should be. I had run upgrades in standalone systems, but never in a distributed deployment. So, I need to upgrade the Primary Admin only and the other nodes would upgrade automatically?
    When upgrading to Cisco ISE, Release 1.2, first upgrade the secondary Administration node to Release 1.2. You do not have to manually deregister the node before an upgrade. Use the application upgrade command to upgrade nodes to Release 1.2. The upgrade process deregisters the node automatically and moves it to the new deployment. If you manually deregister the node before an upgrade, ensure that you have the license file for the Primary Administration node before beginning the upgrade process. If you do not have the file on hand (if your license was installed by a Cisco partner vendor, for example), contact the Cisco Technical Assistance Center for assistance.
    I would need to upgrade 1.1 to 1.2 first and then 1.2 to 1.3? I undertand release 1.1 was in 32 bits, and the version 1.2 and 1.3 are in 64 bits, so I guess the process would take a long time (perhaps a couple of hours), so a maintenance window would need 3 or 4 hours until the full system became stable
    If you are on a version earlier than Cisco ISE, Release 1.2, you must first upgrade to 1.2 and then to 1.3.
    You can upgrade to Cisco ISE, Release 1.2, from any of the following releases:
    Cisco ISE, Release 1.1.0.665 (or 1.1.0 with the latest patch applied)
    Cisco ISE, Release 1.1.1.268 (or 1.1.1 with the latest patch applied)
    Cisco ISE, Release 1.1.2, with the latest patch applied
    Cisco ISE, Release 1.1.3, with the latest patch applied
    Cisco ISE, Release 1.1.4, with the latest patch applied
    Type of Deployment
    Node Persona
    Time Taken for Upgrade
    Standalone (2000 endpoints)
    Administration, Policy Service, Monitoring
    1 hour 20 minutes
    Distributed (25,000 users and 250,000 endpoints)
    Secondary Administration
    2 hours
    Monitoring
    1.5 hours
    After upgrading to ISE 1.2, upgrade to ISE 1.3
    Type of Deployment
    Node Persona
    Time Taken for Upgrade
    Standalone (2000 endpoints)
    Administration, Policy Service, Monitoring
    1 hour 20 minutes
    Distributed (25,000 users and 250,000 endpoints)
    Secondary Administration
    2 hours
    Monitoring
    1.5 hours
    Factors That Affect Upgrade Time
    Number of endpoints in your network
    Number of users and guest users in your network
    Profiling service, if enabled

  • ISE's Internal Root CA. How to generate new one in distributed deployment?

    Hello,
    I have two ISE nodes in distributed deployment. I would like to generate new Internal Root CA certificate. I was able to do that from primary node, but only FOR primary node. How can I achieve this for the other node?
    Best Regards,
    Marek

    Hi Marek-
    All of the certificate management is performed from the Admin Node which becomes the Root CA for the ISE PKI. You generate Subordinate CA certificates to your Policy Nodes from the Primary Admin node. Check this link for more info:
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01000.html#task_FF93B4C51BAC4CA196A48B607DAA595D
    Also, since the primary node is the Root CA, you should export the certificate and the private key and import it to your secondary Admin node. This will enable the secondary node to be promoted to a Root CA in case of a failure of the primary admin node:
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01000.html#concept_435C4E3FF56949B1B4D5A0C73671AB22
    I hope this helps!
    Thank you for rating helpful posts!

  • ISE Distributed Deployment

    Hi All,
    Deploying multiple PSN's with a  distributed deployment, do all the PSN's have to be in the same domain? I  have 8 set up in one domain, and would like to run a few more through  firewalls and using a different dns domain.
    Also interested to see  how AD integration works with this. I'd still expect to join the nodes  to the common AD domain. Would they be able to join an AD domain which  isn't linked with their FQDN?
    I'm hoping that running the other policy nodes on an external domain, I can use a standard CSR for the external public certs.
    All comments, suggestions, spoliers welcomed! Question is out to Cisco but I know the value of these forums too.

    Hi,
    You will have to join all ISE nodes to the same AD domain since the policy for user enforcement (for any external conditions) is configured at the Primary Admin node and replicated down to the PSNs. However, if you choose to configure a different dns domain for one PSN and then join it to the command AD domain, the only issue I see with this is SAMAccount name being sent in the username and not the UPN.
    If a user requests authentication with johndoe and your AD domain is abc.com but your dns domain is def.com, then ISE will try to authenticate [email protected] (from my experience), there have been some improvements where ISE should be able to note that this is an authentication request and should suffix the request with [email protected] but I am not 100 percent sure.
    If you have a cisco account rep (with your deployment size I am absolute sure you do) have them ping the BU on this issue and see what the official response is.
    Thanks,
    Tarik Admani
    *Please rate helpful posts*

  • Upgrading a distributed deployment to ise 1.2, licensing

    The current deployment is a 5 nodes (2adm 1mon 2psn)
    what the docs report is:
    You do not have to manually deregister the node before an upgrade. Use the application upgrade command to upgrade nodes to Release 1.2. The upgrade process deregisters the node automatically and moves it to the new deployment. If you manually deregister the node before an upgrade, ensure that you have the license file for the Primary Administration node before beginning the upgrade process. If you do not have the file on hand (if your license was installed by a Cisco partner vendor, for example), contact the Cisco Technical Assistance Center for assistance.
    we have a 10k base licence+ 100 advanced (only pri adm registered)
    deployment is 1y old
    what happens after the secondary admin node has been upgraded to 1.2?
    will it be accessiblevia gui? will it have a new grace period licence? will it use the other admin node licence?
    this cause during the upgrade we will need to check the "new" 1.2 admin status to proceed with the other nodes...
    thank you

    For distributed deployments, the upgrade  process follows a Split Deployment model. After you upgrade the  secondary Administration node to the new release, Cisco ISE creates a  new deployment. The secondary Administration node from the old  deployment becomes the primary Administration node in the new  deployment. When you upgrade the rest of the nodes in the old  deployment, they join the new deployment.
    When you upgrade the secondary Administration node from the old  deployment, it saves the old deployment configuration       and also  notifies the primary Administration node of the upgrade. The primary  Administration node in the old deployment notifies the other nodes about  the upgrade. After upgrade, the nodes from the old deployment join the  primary Administration node in the new deployment. The upgrade process  retains licenses and certificates. You do not have to reinstall or  reimport them. Cisco ISE, Release 1.2, supports license files with  two-node unique device identifiers (UDIs). You can request for a new  license with the UDI of both the primary and secondary Administration  nodes. See the Cisco Identity Services Engine Hardware Installation Guide for details.
    http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_01.html

  • Distributed deployment migration to Clustering over the WAN

    Hello All,
    The existing deployment is distributed with different CM versions running on each of them i.e 6.1.3(2 Clusters), 7.1.5(1 Cluster) and 8.6(1Cluster). It has been requested to get these clusters migrated to version 10.x in either centralized or CoW deployment. However, some of the clusters have around 1700 and 2600 phones in the cluster and because of SRST gateway sizing limitation, we have to approach CoW deployment. We have CUCM, UCxn(new dep) and MediaSense(new dep) applications. There are currently around 8000 users registered to the CM but considering future expansion, it must be proposed for about 20K users. My questions are :
    1) With UCSS in place, how does the Migration work for different versions? I am not aware of the existing used and unused DLU's in 6.1.3 version and methinks it has to be taken into account to convert into type of Users for UCL.
    2) Without UCSS in place, how tricky does the migration become?
    2) There are 8 sites, with 5 sites having at least 2000 users. Considering future expansion for 20K users, how do we position the number of subscribers in each site for CoW deployment? I understand there are BHCA and bandwidth calculations involved, 1PuB, 1 SuB, 1 TFTP/MOH servr in DC, 1 SUB each in other sites and an additional TFTP server in one of the sites?
    Appreciate the help!
    Q

    Q,
    The first place to start is to look at the cucm 10.X SRND. Look in detail at capacity planning and call processing.
    http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/callpros.html
    Each cucm 10.X node can support a total of 10,000 users/devices using the 10,000 OVA template. The cluster can support a total of 40,000 users/devices. I am sure this will meet your present and future needs.
    Next you need to look at sizing. The cisco virtualization wiki details what to do in this case..
    http://docwiki.cisco.com/wiki/Unified_Communications_in_a_Virtualized_Environment#How_to_Design
    Download the sizing tool from here
    http://tools.cisco.com/cucst/faces/landing.jsp
    Then use the placement tool to determine how you should place your VMs..
    You  may want to send your final output to Cisco to verify your design. Virtualization is not so straight forward as bare metal server deployments, so you need to design carefully.
    From what you have said, looking at about 20,000 users I would suggest the following
    1. 4 cucm subscribers--each deployed with 5,000 users/devices. This setup will allow for one to one backup
    2. 2 dedicated tftp/moh servers
    3. 1 publisher
    That gives you a total of 7 virtual machines. This means that you will need two UCS servers-C series servers
    Although the sizing tool suggested 12 VMs with six subscribers.. (this means that you will need three UCS servers-C series)
    For SRST, depending on how critical the phone system is you either do the ff
    1. Use the voice gateway at the site to support SRST. This obviously is limited to the capacity of the voice gateway at the site
    2. Re-use the existing cucm servers and deploy them at the local site just for SRST. This will ensure you can support the whole site in SRST
    It is advisable to place your UCS servers in your DC. If you have a single DC, then you place one there and then the other at another site (Hq)

  • Distributed Deployment for components

    We are designing a typical distributed web application using the struts framework and ejb.
    The flow designed is as below :
    StrutsController --> ActionForm --> Action --> Business Delegate (Uses Service Locator) --> Session Facade --> ....
    Details :
    The deployment can be at different machines for web tier and for application tier.
    The query is whether business delegate component should be part of client jar file or it should be part of server jar file.
    I think, business delegate and service locator will be part of client jar file as business delegate is used inside the Struts Action class execute() method. And service locator will be used by busiess delegate to get the session facade.
    If service locator component is required at session facade also then should we keep service locator component in server jar also?
    Thanks in advance.

    I think, business delegate and service locator will be
    part of client jar file as business delegate is used
    inside the Struts Action class execute() method. And
    service locator will be used by busiess delegate to
    get the session facade.did the same thing (exactly ;)), both files should be in client.jar
    If service locator component is required at session
    facade also then should we keep service locator
    component in server jar also?yes. if u look up the home references of other session beans or entity beans (marked as ejb-references in the dd) than u can and should use the service locator.
    regards
    dan
    scpj2

  • ISE - Loss of All Nodes in a Distributed Deployment, Recovery Using New IP Addresses and Hostnames

    Hi Experts,
    I have a question regarding ISE disaster recovery with same hostname and IP. For step 2, is it a must to generate a self signed cert? is it possible to use back to original N1 CA- signed certificate?
    esolution Steps
    1. Obtain the N1 backup and restore it on N1A. See "Restoring Data from a Backup" section for more information. The restore script will identify the hostname change and domain name change, and will update the hostname and domain name in the deployment configuration based on the current hostname.
    2. You must generate a new self-signed certificate. See "Generating a Self-Signed Certificate" section for more information.
    3. You must log in to the Cisco ISE user interface on N1A, choose Administration > System > Deployment, and do the following:
    a. Delete the old N2 node. See "Removing a Node from Deployment" section for more information.
    b. Register the new N2A node as a secondary node. See "Registering and Configuring a Secondary Node" section for more information. Data from the N1A node will be replicated to the N2A node.
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-1-1/user_guide/ise_user_guide/ise_backup.html

    Hi,
    The reason for asking to create a self signed cert is , the subject name of the certificate should match  ISE node FQDN. If you import the N1 node CA- signed certificate, that certificate will have the hostname of N1 node as its subject name and it will not work.
    So you have to create a self signed certificate or get a new CA signed certificate with subject name as N1A node FQDN.
    Hope this clarifies the reason of self signed certificate.

  • Distributed deployment of SOA Suite 11g

    Could please anyone guide how to install and run the SOA Suite 11g across 3 different Windows machines. I'd like to setup a SOA Suite WebLogic domain, where the 1st machine is running admin server, the 2nd running soa_server1 and 3rd running bam_server1.
    Thanks!

    If you want to setup like the above requirement do these.
    1. Invoke config wizard. Choose Create domain. Select SOA, BAM & EM.
    2. In the Machines screen, create two machines other than LocalMachine. Modify the listen address of these machines to the respective machine ips.
    Eg: MachineA- localhost
    MachineB - MachineB IP/Hostname
    MachineC- Machine C IP/Hostname.
    3. Assign SOA server to machine A & BAM server to MachineB.
    4. Complete the configuration.
    5. Now run the pack command from $ORACLE_HOME/common/bin with -managed option.
    6. Unpack the domain in MachineB & MachineC.
    7. Start the Admin server in MachineA. Login to Admin Console. Navigate to Servers -> Admin Server -> SSL. In Advanced Section, sethostname verification to NONE. Restart the Admin server.
    8. Start Nodemanager in all the machines. (Make sure you have run setNMProps.sh/cmd before starting node manager)
    9. Login to Admin Console. Start the SOA & BAM servers.
    Note: You must install WLS, Oracle SOA Suite in all the three machines. Make sure your MW_HOME & ORACLE_HOME path are same in all the three machines.
    The following is the EDG guide link
    http://download.oracle.com/docs/cd/E12839_01/core.1111/e12036/toc.htm
    This is not the exact requirement for yours, but it will help you to understand the pack/unpack stuffs.

  • Ironport directory harvest for distributed deployment.

    Hello everyone
     We have running multiple ESAs and one SMA. The ESAs cannot access LDAP, but the SMA can. Is there a way to strengthen directory harvest protection without ESAs LDAP integration?
    Thanks a lot!
    Guido

    No...
    But there are a couple of ways to get LDAP closer to them...
    I'm guessing that the ESAs are in a DMZ, and you're not letting stuff in the DMZ access the LDAP boxes, right?
    Not sure if you're using Exchange, but you could put an Edge box in place, and setup Edgesync.  EdgeSync uses your internal HT boxes to push out just enough AD info (eg valid email addresses) to an ADAM instance on the Edge box.  You wouldn't have to feed it mail, but you could just point the ESAs at the ADAM instance for LDAP lookups...
    Or you could roll your own LDAP sync somehow, using ADAM as your LDAP box in the DMZ.  Or a *nix with an LDAP server on it that just has valid email addresses...

  • Guest portal in distributed setup

    Hi All,
    How does the guest portal or the sponsor portals work in a distrubuted environment where two or more PSNs are running indivudually. Thats is,
    1. does ISE redirects the user to the same guest portal url <PSN1 FQDN>/guestportal or PSN2 FQDN>/guestportal based on which PSN receives the request from a NAD?
    2. how do we setup a generic url for the guest so the users will not see the <PSN1 or 2 FQDN> and could see a url like, example abc.com.us/guestportal regardless which POSN serves the request?
    Thanks
    G

    Hi
    FYI.
    In Cisco ISE distributed deployment, administration and monitoring activities are centralized, and processing is distributed across the Policy Service nodes. Depending on your performance needs, you can scale your deployment. Each Cisco ISE node in a deployment can assume any of the following personas: Administration, Policy Service, and Monitoring. The Inline Posture node cannot assume any other persona, due to its specialized nature. The Inline Posture node must be a dedicated node.
    For regarding generic url configuration, please have a look at the following link:
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_dis_deploy.html#18995

Maybe you are looking for