Cisco SNS-3695-K9 (Commonly referenced as ISE3695-K9) Full English Product Description
1. Short Official Part & License Label
SNS-3695-K9 (Market Alias ISE3695-K9): Cisco Large-Scale Secure Network Server 3695 Dedicated Hardware Appliance for Cisco Identity Services Engine (ISE), 1U Rack-Mount UCS C220 M5 Server, Single Intel Xeon Silver 4116 (12 Cores / 24 Threads), 256GB DDR4 ECC RAM, 8×600GB SAS Drives (RAID 10), 6×1GBASE-T Ethernet Interfaces, UEFI Secure Boot Locked for Cisco ISE OS, Supports up to 100,000 Concurrent Endpoints, Distributed Multi-Persona ISE Cluster Deployment, Integrated CIMC Out-of-Band Hardware Management, End-of-Sale SNS 3600 Series Flagship ISE Platform
2. Full Product Overview
The Cisco SNS-3695-K9, widely known commercially as ISE3695-K9, is the flagship large physical appliance within the SNS 3600 Secure Network Server family, purpose-built exclusively to run Cisco Identity Services Engine (ISE), Cisco’s enterprise zero-trust network access control (NAC) platform. It is built on hardened UCS C220 M5 1U rack server hardware with mandatory UEFI Secure Boot enforcement; only Cisco-signed ISE operating system images can be installed, preventing deployment of generic third-party operating systems.
Designed for ultra-large enterprise campus networks, multi-pod Software-Defined Access (SD-Access) fabrics, multi-site global branch architectures, ACI datacenter integration and high-scale TrustSec microsegmentation environments, the SNS-3695-K9 supports a maximum of100,000 concurrent monitored endpoints. It can operate as a standalone all-in-one ISE node or be segmented into distributed functional personas: Policy Administration Node (PAN), Policy Service Node (PSN), Monitoring & Troubleshooting Node (MnT), and high-capacity pxGrid integration node for scalable multi-node ISE clusters.
This appliance delivers comprehensive identity-driven policy enforcement across wired Catalyst switching infrastructure, Catalyst 9800 wireless controllers, remote VPN gateways, SD-Access fabrics and ACI leaf-spine datacenter fabrics. Core workloads include 802.1X authentication, MAB, web authentication, BYOD lifecycle provisioning, self-service guest access, endpoint posture assessment, and bidirectional threat intelligence sharing via pxGrid. It provides native integration with Cisco Catalyst Center, Catalyst 9800 wireless infrastructure, and Cisco security appliances for end-to-end zero-trust workflow automation.
Lifecycle Status: SNS-3695-K9 reached End-of-Sale (EoS) on August 17, 2023. Supported ISE software releases up to ISE 3.x; successor hardware platform is SNS-3795-K9 and newer SNS-3895-K9 generations. ISE software licensing (Base, Plus, Apex subscription tiers) is ordered separately from base hardware.
Key Differentiator vs SNS-3615-K9 / SNS-3655-K9: Flagship 256GB memory, expanded RAID10 storage array, maximum supported endpoint scale of 100,000 endpoints, and highest authentication throughput within the SNS 3600 lineup. Compared to virtual ISE deployments: Dedicated physical hardware with consistent authentication performance, enterprise redundant storage, built-in CIMC remote lights-out management and secure boot protection unavailable on virtual instances.
3. Complete Hardware Physical & Interface Specifications
Form Factor & Mechanical
-
Rack Form Factor: Standard 1U 19-inch rack-mount chassis (UCS C220 M5 SFF)
-
Dimensions: 44.45 mm (H) × 431.8 mm (W) × 711.2 mm (D) / 1.75 × 17 × 28 inches
-
Unit Weight: 14.5 kg (32 lbs) single PSU; up to 15.9 kg fully loaded with dual PSUs
-
Cooling: Multiple hot-swappable redundant internal cooling fans
-
Power Supply: Single AC PSU standard; optional second redundant AC PSU (80 Plus Platinum certified)
Rear Panel Interface Layout
-
6×10/100/1000BASE-T RJ45 Ethernet ports for ISE service traffic (RADIUS, CoA, pxGrid, logging, SXP)
-
1× Dedicated RJ45 CIMC out-of-band management port for independent hardware administration
-
RJ45 RS‑232 serial console port for OS installation and emergency recovery
-
USB 3.0 Type‑A ports for configuration files, firmware uploads and diagnostics
-
Dual AC power supply slots (primary + optional redundant secondary PSU)
-
Physical security lock slot for anti-theft security cable attachment
Front Panel LED Status Indicators
Global status LEDs: Power, System Health, Critical Fault Alarm, Fan Status, Disk Activity
Per-port Link/Activity LEDs for all six GbE data ports and CIMC management port
Power & Environmental Parameters
-
Input AC Range: Universal 100–264 VAC, 47–63 Hz power input
-
Maximum Total Power Consumption: 770 W fully loaded
-
Operating Temperature: 5°C to 40°C (41°F to 104°F)
-
Storage Temperature: -40°C to 65°C (-40°F to 149°F)
-
Humidity: 10%–90% non‑condensing (operation & storage)
-
Regulatory Certifications: UL 60950‑1 safety, CE, FCC Class A EMC, ICES‑003, VCCI
Base Hardware Configuration
-
CPU: Single Intel Xeon Silver 4116, 2.1 GHz, 12 Cores / 24 Threads
-
Memory: 256 GB DDR4 ECC RDIMM
-
Storage: 8×600GB 10K SAS hard drives, configured as RAID 10 for high redundancy and performance
-
Firmware Security: UEFI Secure Boot, locked to Cisco-signed ISE images only
Verified ISE Scalability Limits
-
Maximum concurrent monitored endpoints: 100,000
-
Supported ISE Personas: PAN, PSN, MnT, pxGrid, Guest Services
-
Authentication throughput: Up to 3,600 PAP authentications/sec (internal identity store)
-
Supports standalone deployment or participation in multi-node distributed ISE clusters
-
Supports up to 200 pxGrid subscribers when deployed as dedicated pxGrid node
-
Log and session retention capacity determined by internal enterprise RAID storage
4. Core Cisco ISE Software Feature Suite
1. Unified Network Access Control
802.1X wired/wireless authentication, MAB, web portal authentication, self-service guest access lifecycle management, BYOD device registration and automatic provisioning.
2. Context-Aware Dynamic Policy Enforcement
Combine user identity, device type, endpoint posture, physical location, time and risk level to enforce granular access policies. Supports dynamic VLAN assignment, downloadable ACLs, RADIUS CoA re-authentication and session termination.
3. TrustSec Software-Defined Microsegmentation
Assign Security Group Tags (SGT) to endpoints; integrates with Catalyst switches, routers, Catalyst 9800 wireless controllers and ACI fabrics for end-to-end group-based segmentation via SXP.
4. Endpoint Posture Assessment
Evaluate endpoint compliance status including OS patches, antivirus presence, disk encryption and host firewall status; automatically quarantine non-compliant devices until remediation requirements are satisfied.
5. Threat Integration & pxGrid Data Sharing
Bidirectional integration with Catalyst Center, Stealthwatch, FTD firewalls and third-party security tools; consume threat intelligence to dynamically isolate compromised endpoints.
6. Identity Federation
Synchronize identity repositories with Active Directory, LDAP, RSA SecurID, and support SAML SSO for unified identity management across multi-domain environments.
7. Monitoring, Reporting & Compliance
Centralized MnT logging, real-time session visibility, persistent audit trails, customizable compliance reports aligned with PCI DSS, HIPAA and enterprise security governance requirements.
8. High Availability & Operations
-
Standalone deployment or cluster member for distributed ISE architecture
-
Independent persona separation to scale authentication and monitoring workloads
-
Scheduled full configuration backup and restore capability
-
Independent CIMC out-of-band power cycling, remote KVM and hardware diagnostics
9. Programmability & Orchestration
-
Embedded HTML5 GUI, local CLI access
-
Comprehensive REST APIs for integration with automation platforms, ticketing systems and SIEM solutions
-
Operates under Cisco ISE subscription licensing model
5. Typical Deployment Scenarios
-
Ultra-large enterprise primary ISE cluster node for campus wired and Catalyst 9800 wireless NAC
-
High-capacity distributed Policy Service Node (PSN) deployed at central datacenter aggregation sites
-
Centralized MnT monitoring node for consolidated logging and long-term compliance reporting
-
TrustSec SGT enforcement and multi-pod SD-Access zero-trust fabric integration
-
Dedicated high-scale pxGrid node for multi-product security ecosystem integration
-
Pre-production lab and proof-of-concept environment for large-scale ISE validation
-
Migration intermediate platform before upgrading to newer SNS-3700 / SNS-3800 ISE appliance generations
6. Short Sales Listing Tagline
Cisco SNS-3695-K9 (ISE3695-K9) Legacy 1U Rackmount Flagship Large-Scale ISE Dedicated Secure Network Server, Built on UCS C220 M5, Single Xeon Silver 4116 (12C/24T), 256GB DDR4 RAM, 8×600GB SAS RAID10 Storage, 6×1GBASE-T Ports, Integrated CIMC Out-of-Band Hardware Management, UEFI Secure Boot Restricted for ISE OS, Supports up to 100,000 Concurrent Endpoints, Runs Cisco Identity Services Engine for NAC, TrustSec Microsegmentation & Zero-Trust Access, Deployable as Standalone or Multi-Persona Cluster Node, End-of-Sale Flagship ISE Hardware for Ultra-Large Enterprise, Multi-Pod SD-Access and Global Multi-Site Networks
Note: Official ordering part number isSNS-3695-K9, widely referenced in market listings as ISE3695-K9. SNS 3600 lineup: SNS-3615-K9 (Small), SNS-3655-K9 (Medium), SNS-3695-K9 (Large). Successor hardware: SNS-3795-K9.
