ISE Distributed - PSNs associated to Specific RSA Servers

Samuel Vuillaume — Tue, 17 Apr 2018 21:36:10 GMT

Hey guys

Quick question.

I have been reading about this but I would like to get confirmation as it gets quite confusing lol

Anyway, my client has an ISE distributed env based on Dedicated PAN, Mnt and PSNs

They will be using many RSA servers as external identity sources.

Because of the distribution of the PSNs group of network devices (NAD group) will be using specific PSNs and other group of NADs other PSNs.

Question:

—————

For specific groups of devices (NAD grouped per location for example) can they use a specific RSA server? As

PSN1—RSA1 primary

|___RSA2 sec

PSN2—RSA2 primary

|___RSA1 sec

This seems possible using rule based authentication policies in ISE.

However although it seems to be based on specific ISE attributes only part of the ISE dictionary

It seems we can group PSN together as a mode group.

So in this case I can def configure each NAD to point to specific “node group” then using rule based authentications asking these Node groups (based on device IP or device network group or location) to use a specific RSA servers.

If you could chime in I would appreciate.

Thank you

Re: ISE Distributed - PSNs associated to Specific RSA Servers

paul — Wed, 18 Apr 2018 16:49:34 GMT

I don't think you can use node groups in Auth criteria, but just use the PSN hostname attribute:

Re: ISE Distributed - PSNs associated to Specific RSA Servers

hslai — Wed, 25 Apr 2018 03:17:26 GMT

Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.

If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.

topic Re: ISE Distributed - PSNs associated to Specific RSA Servers in Network Access Control

ISE Distributed - PSNs associated to Specific RSA Servers

Re: ISE Distributed - PSNs associated to Specific RSA Servers

Re: ISE Distributed - PSNs associated to Specific RSA Servers