The smallest Cisco ISE deployment consists of two Cisco ISE nodes with one Cisco ISE node functioning as the primary node.

The primary node manages all configuration, authentication, and policy tasks for your network. The secondary node acts as a backup. If connectivity is lost between the primary node and network appliances, network resources, or RADIUS, the secondary node supports the primary node and keeps the network running.

Centralized authentication, authorization, and accounting (AAA) operations between clients and the primary node are performed using the RADIUS protocol. Cisco ISE synchronizes all content from the primary node to the secondary node. In a small network deployment, you can configure both nodes on all RADIUS clients by using this model or a similar approach.

If you want to add more devices, network resources, users, or AAA clients, switch from the small deployment model to a split or distributed deployment model.

A split deployment in Cisco ISE separates key personas across different nodes, for example, running the Administration and Monitoring personas on one node and the Policy Service persona on separate nodes. This deployment model improves performance and scalability by isolating policy processing from management and reporting functions.

Split deployment provides better load distribution and ensures that the secondary node remains functional during normal network operations. This design also supports deployment expansion.

In split deployments, the AAA load is split between the primary and secondary nodes to optimize the AAA workflow.

Each node must be able to handle the full workload if there are any problems with AAA connectivity. During normal network operations, neither the primary node nor the secondary node handles all AAA requests, because the workload is distributed between the two nodes.

In split deployments, each node can perform its own specific operations, such as network admission or device administration, and still perform all the AAA functions if a failure occurs. If two nodes process authentication requests and collect accounting data from AAA clients, configure one node to act as a log collector.