topic Inline Posture between Cisco ISE and Wireless LAN Controller in Network Access Control

Inline Posture between Cisco ISE and Wireless LAN Controller

sinan.tekincan — Mon, 11 Mar 2019 01:49:42 GMT

Hi,

I was looking into Cisco ISE solution for deploying NAC.

I have a question about the network topology.

In the user guide documents of cisco ISE, it is written that for Wireless LAN Controllers (WLC) and VPN devices, an additional server, Inline Posture, is needed.

However, in the following integration document, there is not an inline posture between WLC and Cisco ISE server.

https://supportforums.cisco.com/docs/DOC-18121

I want to know if Inline Posture is a requirement, if not a requirement, what are the benefits of having it between Cisco ISE Server and WLC.

Thanks & Regards

Sinan

Re: Inline Posture between Cisco ISE and Wireless LAN Controller

jilahbg — Sat, 18 Feb 2012 19:51:24 GMT

When doing posture assesment, ISE Needs to send information ack to the network device to change parameters, for example vlan change. In switches this is done with CoA, an extention to the radius protocol.

WLC doesnt support CoA as of v7.1.

Sent from Cisco Technical Support iPad App

Inline Posture between Cisco ISE and Wireless LAN Controller

jrabinow — Sun, 19 Feb 2012 22:22:17 GMT

Later versions of WLC do support COA. There are versions currently shipping that do support COA

Inline Posture between Cisco ISE and Wireless LAN Controller

muhammk2 — Wed, 18 Sep 2013 01:13:00 GMT

Hello,

Please go through below mentioned links which might be helpful for you.

http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_ipep_deploy.html

http://www.cisco.com/en/US/docs/security/ise/1.2/installation_guide/ise_deploy.html

Best Regards,

Inline Posture between Cisco ISE and Wireless LAN Controller

Venkatesh Attuluri — Mon, 23 Sep 2013 12:45:33 GMT

An Inline Posture node is a gatekeeper that enforces access policies and handles change of authorization (CoA) requests.

following link "Cisco Identity Services Engine Network Component Compatibility, Release 1.2" Lists NAD that support "Session CoA"

http://www.cisco.com/en/US/docs/security/ise/1.2/compatibility/ise_sdt.html