ISE Authorization when using proxy RADIUS for Authentication

cs_macker — Thu, 04 Jan 2018 16:26:48 GMT

Hi All,

I am trying to develop a policy that will allow me to apply ISE Authorization when using a proxy RADIUS server

I believe I have the authentication part sussed. I.E if: wired 802.1x Use proxy Service: <external identity sequence>

The difficult I am having is matching this with a condition on the Authorization policy. For example, I would like the authorisation policy to say something along the lines of:

If: Proxy RADIUS state is active - Then: <Permissions>

If: Proxy Radius authentication successful - Then: <permissions>

I need this match as I am trying to authenticate 2 different groups of users using 802.1x via two different authentication methods (external RADIUS server and AD)

Do you have any ideas as to which conditions could be used to achieve this? below image included to try and demonstrate what I am trying to achieve:

Many Thanks in advance

Paul

Re: ISE Authorization when using proxy RADIUS for Authentication

paul — Fri, 05 Jan 2018 14:44:56 GMT

How are you driving the authentication to your Proxy RADIUS server vs. AD? It looks like you have Wired_802.1x in both lines.

Are the proxy RADIUS usernames also in AD? If not you simply could add an AD group criteria to your authorization rules for the AD users. The proxy RADIUS users wouldn't pass that criteria.

Also the Network Access->AuthenticationIdentityStore condition may tell you what you need as well.

topic Re: ISE Authorization when using proxy RADIUS for Authentication in Network Access Control

ISE Authorization when using proxy RADIUS for Authentication

Re: ISE Authorization when using proxy RADIUS for Authentication