PSN - Dual Interface Routing Issue

keviande — Tue, 07 May 2019 16:40:41 GMT

Have a customer with the following setup with a Virtual ISE deployment - Separate PSN running 2.4 with latest patch

PSN interfaces are setup as follows:

Eth0 - is intended to be used as management only with communication to PAN, MnT, DNS, NTP, AD etc...

Eth1 - is intended for RAIDIUS/TACACS session data from the NADs only - there is a Loadbalancer in front of multiple PSNs

I've read conflicting information in Topic searches that a PSN can have two default routes (other articles that say no) - one for each interface - whereby traffic that ingresses an interface will route back out that interface with the associated default route. Customer is having an issue where traffic is coming into Eth1 interface and but routing back out Eth0 interface - where the ip default-gateway command points to. Setting static route statements according to customer would be significant work because of the size of the network on either side - which is why he's trying to get this to work if it can.

Understand from a networking standpoint how problematic multiple defaults routes can be without something else like PBR making the decision but the customer was pretty sure saw in the documentation that this could work and I've seen these articles as well.

Any thoughts and help would be appreciated

Kevin

Images of interface configuration and show ip route below

Re: PSN - Dual Interface Routing Issue

howon — Wed, 08 May 2019 17:36:19 GMT

I don't believe we supported dual default gateway. We recommend specific routes defined so it can be exited out the same interface. If you have any document saying otherwise, can you share the link?

Re: PSN - Dual Interface Routing Issue

hslai — Sun, 12 May 2019 05:41:25 GMT

As discussed, howon is correct.

CLI ip route has an example on multiple default routes. And, I tested both RADIUS and SNMP working OK using a L3 client direct its requests to Interface Gi1 of an ISE 2.4 in my lab and monitoring the connections to Gi1 with the TCPDUMP tool.

topic Re: PSN - Dual Interface Routing Issue in Network Access Control

PSN - Dual Interface Routing Issue

Re: PSN - Dual Interface Routing Issue

Re: PSN - Dual Interface Routing Issue