topic Re: Authenticate from NAT outside endpoint in Network Access Control

Authenticate from NAT outside endpoint

azhakama — Fri, 15 Sep 2017 13:52:29 GMT

I want to confirm if it is possible to authenticate from NAT inside endpoints but also from outside endpoints(which have Global IP address).

It seems to work if ISE is Static NATed, but is it supported structure?

Outside<- | ->Inside

Global IP address endpoints --- GW(Global IP)-----| NAT Router |---- ISE(Static NATed) |----- Private IP address endpoints(PATed)

Jason Kunst — Fri, 15 Sep 2017 14:40:16 GMT

NNot officially tested but has been working for years

azhakama — Mon, 18 Sep 2017 14:34:09 GMT

Thank you for the reply. Could you kindly tell me what type of authentication is used ?

My customer's environment is going to be MAB, Web Auth, dot1x mixed. These are on Wired and Wireless.

And in the future, they are planning to use Dynamic VLAN, Downloadable ACL or Trustsec.

It still seems working fine when ISE is Static NATed, however, please let me know if there is any known issue.