topic Re: Load Balancing in Network Access Control

Load Balancing

BK_CiscoUser — Mon, 24 Jun 2019 18:53:31 GMT

If ISE is installed behind a load balancer, with the load balancer as the default gateway, will the source IP of the device be still kept?

Re: Load Balancing

Damien Miller — Mon, 24 Jun 2019 19:36:43 GMT

The suggested way of configuring the load balancer would be to pass through the NAD IP. The alternative, source nat, would mask the NAD IP.

There are some decent ISE load balancing guides if you go down this route.
https://community.cisco.com/t5/security-documents/ise-load-balancing/ta-p/3648759

Re: Load Balancing

Jason Kunst — Mon, 24 Jun 2019 19:41:51 GMT

I would recommend checking out the presentation on performance and scale there are slides under the resources showing you the different options and recommendations

https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148

Also under http://cs.co/ise-guides there are load balancing docs

Re: Load Balancing

Arne Bier — Mon, 24 Jun 2019 23:44:10 GMT

short answer is yes, if the load balancer is not doing Source NAT'ing.

If the load balancer is doing Source NATing, then it's changing the IP packet header and putting its own IP address as the source of the traffic. Hence, you lose the "origin" of the traffic. You can still glean the origin via the NAS IP Address field in the RADIUS packet. But ISE doesn't use that field. It uses the IP/UDP Source IP Address.