ISE-PIC support for multiple tenants with FMC

dadelima — Wed, 13 Jun 2018 13:03:27 GMT

Hi Team,

I have multiple tenants (government agencies) that are managed by a single FMC (and multiple FTD instances per tenant). Each tenant has overlapping addressing and NAT is used heavily to present FMC with unique address space as well as for routing their traffic up to a shared Internet Gateway.

There is a requirement to use identity-based AC policy rules in FMC/FTD.

What is the best way to provide user/IP mappings via ISE-PIC??

Can a single ISE-PIC support AD Forest/Domain connections to multiple tenants??

How would ISE-PIC present the IP mappings?? (ie would it be the original un-NAT'd IP??). If so, how does FMC interpret the potentially overlapping user/IP mappings from ISE-PIC if mapped to a single realm thats mapped to a single identity policy to a single AC policy??

Thanks and kind regards,

Dave.

Re: ISE-PIC support for multiple tenants with FMC

Nidhi — Wed, 13 Jun 2018 15:24:37 GMT

Hello Dave,

ISE-PIC supports 100 DC today. FMC gets to know about the group mapping learnt from AD.

you can verify in ISE under live sessions and check the IP mapping which is sent to FMC via PxGrid.

Please find more details from the link here- https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/210522-Configure-ISE-2-2-PIC-with-Active…

Thanks,

Nidhi

topic Re: ISE-PIC support for multiple tenants with FMC in Network Access Control

ISE-PIC support for multiple tenants with FMC

Re: ISE-PIC support for multiple tenants with FMC