External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs

hevyapan — Thu, 07 Feb 2019 15:55:57 GMT

Hi team,

I am having a hard time to solve a design issue. There are two companies who have a direct connection between them and time to time the employees move between the companies. Both of the companies are using ISE and have their ADs, Wired/Wireless NAC is also in place. Request is to have the User A from Company A to be able to Authenticate with his credentials on Company B's NADs and same the other way. I am trying to understand the possibility of External RADIUS Server as they don't want to have the Multi-AD integration. If I create a rule with RADIUS Sequence as far as I understand from the document, it will try the first ISE then if it doesn't receive a response, it will move on to the next-one. But how about the RADIUS-Reject scenario? Do we try each RADIUS Servers till we have RADIUS-Accept or finish all the RADIUSes or first time we receive a RADIUS-Reject we stop the process completely? Or how can I achieve the granularity on Authentication Policy based on the company that user belongs to?

Any response or guidance will be much appreciated!

Regards,
Efe

Re: External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs

paul — Thu, 07 Feb 2019 16:00:53 GMT

I would do the following:

Company A defined Company B's ISE PSNs as an external RADIUS token server in their ISE deployment.
Company A defined an identity source sequence that checks Company A AD then Company B external RADIUS server.
Company B does the reverse of that.

The only danger in that setup is if an AD account with the exact same name exists in Company A AD for a Company B user, but hopefully that risk should be minimal

topic External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs in Network Access Control

External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs

Re: External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs