topic Re: PSNs with 2 interfaces for guest authentication in Network Access Control

PSNs with 2 interfaces for guest authentication

umahar — Fri, 21 Feb 2020 19:01:18 GMT

We have an ISE Guest cluster with PSNs having 2 interfaces.

One interface receives the radius request and the other interface receives the web redirected traffic.

WLC----internal-network-----PSN---------------router

During failover testing we shut down the router interface.

WLC was still sending radius request to the internal-network interface of PSN because it was still alive. Endpoints when getting redirected to the other interface of the PSN are getting dropped.

Is there a way for PSN to start dropping radius request on one interface if the second interface goes down ?

Re: PSNs with 2 interfaces for guest authentication

Francesco Molino — Wed, 01 Aug 2018 02:49:47 GMT

Hi Umahar

I'm sorry but what's your question?
I thing you're missing a part of your post.

Re: PSNs with 2 interfaces for guest authentication

umahar — Wed, 01 Aug 2018 13:54:29 GMT

oh ya, I thought my post was autosaved. Still getting used to the new interface 🙂

Re: PSNs with 2 interfaces for guest authentication

Francesco Molino — Wed, 01 Aug 2018 22:02:02 GMT

Unfortunately there's no tracking feature to do so and that's why I always implement ISE with multiple interfaces but use anycast design. As you can't shutdown the interface because tracking isn't there and you don't have access to linux shell, radius packets still go through the default ISE interface and it will redirect endpoints to a anycast IP which means:

- if interface 2 is down on ISE node 1, the routing will redirect the user to the same IP located on ISE node 2.

Do you follow me here?

Otherwise, for customers who have Load-balancers, they can achieve the same thing by returning LB VIP and LB will be in charge to redirect traffic to ISE node 1 or 2.

Re: PSNs with 2 interfaces for guest authentication

hslai — Mon, 06 Aug 2018 03:23:40 GMT

See also PSNs with 2 interfaces for guest authen... (by umahar on 08-01-2018 11:41 AM)

Re: PSNs with 2 interfaces for guest authentication

hslai — Mon, 06 Aug 2018 03:23:42 GMT

See also PSNs with 2 interfaces for guest authen... (by umahar on 08-01-2018 11:41 AM)