• The Amazon VPC supports only Layer 3 features. Cisco ISE nodes on AWS instances do not support Cisco ISE functions that depend on Layer 1 and Layer 2 capabilities. For example, working with DHCP SPAN profiler probes and CDP protocols that use the Cisco ISE CLI is currently not supported. The communication from on-prem devices to the VPC must be secure.
• NIC bonding is not supported.
• Dual NIC is supported with only two NICs—Gigabit Ethernet 0 and Gigabit Ethernet 1. To configure a secondary NIC in your Cisco ISE instance, you must
  1. Create a network interface object in AWS.
  2. Power off your Cisco ISE instance.
  3. Attach this network interface object to Cisco ISE.
  4. Install and launch Cisco ISE on AWS.
  5. Use the Cisco ISE CLI to manually configure the IP address of the network interface object as the secondary NIC.
• Amazon EC2 user data scripts are not supported.

You cannot

• take an Amazon EBS snapshot of a Cisco ISE instance and then create another EBS volume with the snapshot
• configure an IPv6-based NTP server when launching Cisco ISE through AWS. From Cisco ISE release 3.5, IPv6-based NTP servers are supported for both dual-stack and pure IPv6 instances.
• change the IP address of an instance after it has been created successfully, and
• generate the initial administrator user account name. An initial administrator user account name, iseadmin, is generated by default. This user account name is used for both SSH and GUI access to Cisco ISE after the installation process is complete.

Cisco ISE sends traffic to AWS Cloud through IP address 169.254.169.254 to obtain the instance details. This is to check if it is a cloud instance and can be ignored in on-prem deployments.

These are the CLI limitations.

• SSH access to Cisco ISE CLI using password-based authentication is not supported in AWS. You can only access the Cisco ISE CLI through a secured key pair. If you use a private key (or PEM) file and you lose the file, you will not be able to access the Cisco ISE CLI. Any integration that uses a password-based authentication method to access Cisco ISE CLI is not supported, for example, Cisco Catalyst Center release 2.1.2 and earlier.
• In Cisco ISE release 3.1, when you run the show inventory command through a Cisco ISE instance that is launched through AWS, the output does not display the instance type of the Cisco ISE on AWS. This issue is resolved in Cisco ISE release 3.1 patch 1 and later releases.

These are the memory, disk size, and volume limitations:

• You cannot resize an EC2 instance.
• You cannot convert the Cisco ISE Disk EBS Volume as an AMI and then relaunch another EC2 instance with this AMI.
• In the Cisco ISE CFT that you configure, you define volume size in GB. However, AWS creates EBS storage volumes in Gibibyte (GiB). Therefore, when you enter 600 as the Volume Size in the Cisco ISE CFT, AWS creates 600 GiB (or 644.25 GB) of EBS volume.
• You might receive an Insufficient Virtual Machine Resources alarm when Cisco ISE is in idle state. You can ignore this alarm because the CPU frequency is maintained lower than the required baseline frequency (2 GHz) for effective power conservation.

These are two deployment types supported, but you must ensure that internode latencies are less than 300 milliseconds.

• Hybrid deployments with some Cisco ISE nodes on premises and some nodes in AWS.
• Interregional deployments through VPC peering connections.

Cisco ISE upgrade workflow is not available in Cisco ISE on AWS. Only fresh installs are supported. However, you can carry out backup and restore of configuration data.

References

Refer to Upgrade Guidelines for Hybrid Deployments for information on upgrading hybrid Cisco ISE deployments.

You can integrate the external identity sources that are located on the premises. However, because of latency, when on-premises identity sources are used, Cisco ISE's performance is not at par with Cisco ISE's performance when AWS-hosted identity sources or the Cisco ISE internal user database is used.

These are the user data backup and restore limitations.

• User data retrieval only works for Metadata V1 (IMDSv1); it does not work with V2.
• When restore operation is run during a configuration data backup through the Cisco ISE CLI or GUI, ADE-OS parameter should not be included.