topic Re: Device Administration Using RADIUS in Network Access Control

Device Administration Using RADIUS

hradhanp — Fri, 21 Feb 2020 19:01:30 GMT

Hi Team,

One of my customer has WLC and AP which doesn't support TACACS so they want to to the device administration using RADIUS. We have completed the POC for the customer but need to understand the License consumption. Do we need to include device admin license along with the 100 base license or only base license is enough.

Regards,

Hiten R

Re: Device Administration Using RADIUS

RichardAtkin — Tue, 14 Aug 2018 11:09:45 GMT

If you're only using RADIUS for device admin instead of TACACS+, then BASE is fine.

Re: Device Administration Using RADIUS

hradhanp — Tue, 14 Aug 2018 11:14:18 GMT

How about the license consumption ? Is it based on device or based on session ?

Re: Device Administration Using RADIUS

Arne Bier — Tue, 14 Aug 2018 20:36:07 GMT

Every successful Radius Authentication&Authorization for an Endpoint will consume 1 base license. If the same Endpoint has 1000 repeat authentications then it's still only 1 base license consumed. The NAS should ideally send Radius Accounting to ISE, because ISE uses that to track the session for that endpoint - and when WLC sends accounting Stop for that endpoint, then ISE should free up the license for that endpoint.

If you don't send Radius accounting then ISE has some internal logic when it decides to free up the license. I forget what the time interval is - it's like 1 hour or something. it's very crude.