Aruba Central for Managing IAP Feedback

[Street, Chad A]

Hello fellow wireless minions, for anyone currently using Aruba Central to 
manage IAPs, could you kindly provide feedback on your experience.   Pros, 
Cons, satisfaction with the user interface, oddities and any other interesting 
experiences you have to share would be most welcome.

Feel free to email me privately below.

Best regards, Chad Street
Emory University and Healthcare
chad.str...@emory.edu

**
Replies to EDUCAUSE Community Group emails are sent to the entire community 
list. If you want to reply only to the person who sent the message, copy and 
paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community

RE: [WIRELESS-LAN] can Active Directory backend for ISE be tested before adding all wireless auth?

[Jeffrey D. Sessler]

As a point of reference, if you are cloud-based and have deployed Microsoft’s 
AADDS (Azure Active Directory Domain Services), the architecture model for that 
service puts a LB in front of the DCs to assist with service scale out, 
including replica sets across geographic regions.

One could accomplish this within each individual service, but as the number of 
services increases, there is a point where hiding that complexity behind a LB 
makes the management a bit easier including DR/business continuity.

Jeff

From: The EDUCAUSE Wireless Issues Community Group Listserv 
 On Behalf Of Manon Lessard
Sent: Tuesday, August 03, 2021 8:48 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] can Active Directory backend for ISE be tested 
before adding all wireless auth?

Spurgeon

We tend to load balance a whole bunch of things, but I would really be 
concerned about load balancing AD servers because the VS would itself add some 
latency. Not saying it wouldn’t work, just my own experience.
I would rather rely on dedicating AD servers to some “site” and use the “site” 
as a way to establish a pecking order. So the stuff that’s crucial (ex: Auth) 
would be tied to a “critical” site, and thus be served first.

Also, I would strongly suggest that the groups which are whitelisted and added 
are not too large. They are only what the ISE server has to use to lookup 
users. With ISE the AD connector can deal with not being everywhere, make good 
use of it. ACS 5 didn’t have that capability and thus was real slow, esp. since 
it had to browse the whole thing.

And remember, ad_agent.log  is your friend, if it whines, there’s a problem.

Manon Lessard
Chargée de programmation et d’analyse
CCNP, CWNE #275, AWA 10, ESCE Design
Direction des technologies de l'information
Pavillon Louis-Jacques-Casault
1055, avenue du Séminaire
Bureau 0403
Université Laval, Québec (Québec)
G1V 0A6, Canada
418 656-2131, poste 412853
Télécopieur : 418 656-7305
manon.less...@dti.ulaval.ca
www.dti.ulaval.ca
Avis relatif à la confidentialité | Notice of 
Confidentiality


From: The EDUCAUSE Wireless Issues Community Group Listserv 
mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>> 
on behalf of "Spurgeon, Charles E" 
mailto:c.spurg...@austin.utexas.edu>>
Reply-To: The EDUCAUSE Wireless Issues Community Group Listserv 
mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>>
Date: Tuesday, August 3, 2021 at 11:41 AM
To: 
"WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU" 
mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>>
Subject: Re: [WIRELESS-LAN] can Active Directory backend for ISE be tested 
before adding all wireless auth?

I have no answer for dev testing of AD performance. However, I do have some 
links to Cisco info on ISE scaling and deployment that I saved for future ref. 
Here they are in case they may be of use:

  1.  “2019 How Cisco Deployed ISE”
https://www.ciscolive.com/global/on-demand-library.html?search=dgtl-brkcoc%20ise=dgtl-brkcoc+ise#/session/1573153539632001Je9Y
  2.  2018 – “Designing ISE for Scale and High Availability”
https://www.ciscolive.com/global/on-demand-library.html?search=dgtl-brkcoc%20ise=dgtl-brkcoc+ise#/session/1500302030233001WuLd
  3.  “ISE Peformance and Scale” community doc with current updates:
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148

FWIW, I recall hearing somewhere (probably a