topic Re: ISE as RADIUS proxy, would CoA work? in Network Access Control

ISE as RADIUS proxy, would CoA work?

mabriand — Wed, 16 Jan 2019 16:46:18 GMT

Hello,

I'm currently investigating ISE and DUO integration with ASA for remote access VPN. One of the options is to have ISE proxy RADIUS requests to the DUO Auth Proxy.

I was wondering if CoA (sent by ISE to ASA) would still be functional in that scenario. I'm ultimately seeking to understand if posture would be possible in that type of setup.

Best Regards,

Martin

Re: ISE as RADIUS proxy, would CoA work?

paul — Wed, 16 Jan 2019 18:04:17 GMT

I usually don't use the RADIUS proxy setup. I prefer the RADIUS token server setup when integrating with 2FA vendors. In that scenario I know CoA and posturing works just fine. I would assume it should work with the RADIUS proxy setup.

You can test it easily enough. Get a device connected on VPN with DUO as RADIUS proxy in ISE. Go to the live sessions screen and find the session. Click Reauthentication for CoA actions and see if you see an authentication in the live logs.

Re: ISE as RADIUS proxy, would CoA work?

mabriand — Thu, 17 Jan 2019 08:10:43 GMT

Thanks Paul, spot on.

Not sure why I drifted from Radius Token server to RADIUS proxy instead.

Indeed with usage of DUO Auth Proxy as a RADIUS token server, there's no concern anymore.

I'm still curious about RADIUS proxy and CoA and will test that whenever I get access to a lab setup with ISE and another RADIUS server.

Best Regards,

Martin

Re: ISE as RADIUS proxy, would CoA work?

Sheraz.Salim — Thu, 17 Jan 2019 17:41:18 GMT

kindly please do not forget to share your finding with us.