topic Re: ISE 3rd Party Compatibility with HP in Network Access Control

ISE 3rd Party Compatibility with HP

Nick3 — Fri, 28 Jul 2017 00:37:20 GMT

I am looking into the support for posturing & BYOD services for ISE using HP 5500 series switches, along with configuration examples.

I am aware of the "ISE Third-Party NAD Profiles and Configs" guides provided in the community pages and has a NAD profile for "HP_Wired_SNMP_CoA." When I look in the ISE 2.2 configuration guide it shows the CoA type being RADIUS and then under the table references the community pages.

My question is if the "HP_Wired_SNMP_CoA" profile is the same configuration that was used to test the compatibility of HP with ISE for those services using RADIUS? If not, where may I get the RADIUS configuration guide that was used to test this and of what version of HP was this done for (5.20.99 Release 5206)?

Also, why do I see a difference in support compatibility between the ISE compatibility matrix and that in the config guide?

Config Guide:

- Cisco Identity Services Engine Administrator Guide, Release 2.2 - Manage Network Devices [Cisco Identity Services Engin…

ISE Compatibility Matrix:

- Cisco Identity Services Engine Network Component Compatibility, Release 2.2 - Cisco

ISE Third-Party NAD Profiles and Configs:

- ISE Third-Party NAD Profiles and Configs

Re: ISE 3rd Party Compatibility with HP

thomas — Fri, 28 Jul 2017 16:51:30 GMT

Thank you for pointing out the inconsistency in the documentation.

I've forwarded this thread to the ISE Documentation team to fix it!

Re: ISE 3rd Party Compatibility with HP

Nick3 — Fri, 28 Jul 2017 17:41:26 GMT

Thank you Thomas!

Do you know if the "HP_Wired_SNMP_CoA" NAD profile is the configuration used to test the feature capabilities of ISE & HP 5500s using RADIUS as shown in the configuration guide? If so, why is the NAD profile named SNMP?

Thank you!

Re: ISE 3rd Party Compatibility with HP

smashash — Sun, 30 Jul 2017 07:16:32 GMT

Yes. This NAD profile has the SNMP in name to differentiate between RADIUS CoA and SNMP CoA.

This device (HP(H3C) 5500 - 5.20.99 Release 5206) doesn't support RADIUS CoA. Therefore, we have validated/tested using SNMP CoA.

Re: ISE 3rd Party Compatibility with HP

Nick3 — Mon, 31 Jul 2017 16:49:03 GMT

Thank you for the reply!

Would you be able to clarify for me, why the ISE 2.2 configuration guide shows that for wired HP 5500 it was tested with a CoA type of RADIUS? Is this a different HP 5500 model or should the CoA type say SNMP?

- http://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01000.html#concept_600D0598D1DE4D47B5321DD966E1C4CE

I look forward to hearing from you.