topic Re: multi LNS server IP balanced by ISE response in Network Access Control

multi LNS server IP balanced by ISE response

Weiborao — Thu, 10 Aug 2017 15:57:54 GMT

Hi, Dear ISE Experts

My customer have L2TP authentication requirement, need ISE to return LNS server IP to LAC. Customer have multiple LNS servers, hope ISE can return LNS server IP with round robin. Does ISE support it?

If not support round robin, does ISE support returning multiple LNS IP addresses to the LAC ?

BTW, all LAC authentication will use same user name with no password.(or we can say no authentication required)

Thanks

Re: multi LNS server IP balanced by ISE response

Weiborao — Thu, 10 Aug 2017 16:29:05 GMT

Hi Jason

Yes you are right.

I am working with David Li, who is the local Security Expert in China Team.

I think it is the LAC that decide how to load-balancing between the LNS addresses returned from the attribute 67.

Tunnel-Server-Endpoint

IP address of the LNS that establishes a tunnel. The IP address is in dotted decimal notation. A tag can deliver a maximum of eight IP addresses, with each IP address separated by a space. Multiple IP addresses work in primary/secondary mode.

Re: multi LNS server IP balanced by ISE response

hslai — Sun, 13 Aug 2017 03:36:24 GMT

Please consult with the support teams for the network device platform as to the specifics to return from a RADIUS server.

For instance, VPDN Configuration Guide, Cisco IOS Release 12.4 - Configuring AAA for VPDNs [Cisco IOS Software Releases 12.4 Mainline] - Cisco mentions to use either Cisco VSA (cisco-av-pair) or RADIUS tunnel attributes. The examples I found are all using very old ACS releases, but I believe they would be similar to the following ISE authorization profiles.

Re: multi LNS server IP balanced by ISE response

Weiborao — Sun, 13 Aug 2017 09:56:59 GMT

Hi, hslai

Thank you very much for you reply and contribution.