topic Different Interface for ISE Internet Traffic in Network Access Control

Different Interface for ISE Internet Traffic

meetneelesh79 — Fri, 21 Jul 2017 15:00:41 GMT

Team,

Can we use different interface of ISE for Internet traffic only? Customer wants to use seperate ISE interface for internet traffic only. All other traffic like radius, portal will go through default interface.

Thanks,

Neelesh Marathe

Re: Different Interface for ISE Internet Traffic

hslai — Fri, 21 Jul 2017 15:53:36 GMT

That should be fine. The only restriction is that interface Gi0 for management.

Re: Different Interface for ISE Internet Traffic

Arne Bier — Mon, 24 Jul 2017 00:19:49 GMT

Neelesh

By "internet traffic" do you mean ISE connecting to the internet for things like Smart Call Home, Profile updates, Client Provisioning Update Feed URL?

Re: Different Interface for ISE Internet Traffic

meetneelesh79 — Mon, 24 Jul 2017 01:39:04 GMT

Hello Arne,

Yes. Correct

Thanks,

Neelesh Marathe

Re: Different Interface for ISE Internet Traffic

Arne Bier — Mon, 24 Jul 2017 02:49:57 GMT

Just wondering whether your internet traffic is considered to be "management" or not. The term 'management' in this context is probably overloaded - but it would be interesting to know what management traffic has to use Gig0 (SSH, SNMP, NTP, intra-node ISE traffic, etc.)

Re: Different Interface for ISE Internet Traffic

hslai — Mon, 24 Jul 2017 02:59:45 GMT

Inbound SSH to ISE admin CLI, inbound HTTPS to the ISE admin web portal, and inter-node replications/communications for the deployment, mainly.

Re: Different Interface for ISE Internet Traffic

meetneelesh79 — Mon, 24 Jul 2017 03:11:32 GMT

Hello Hsing,

Is it possible to route internet only traffic through different interface of ISE? I know we can use different interface for portals

Thanks,

Neelesh Marathe

Re: Different Interface for ISE Internet Traffic

hslai — Mon, 24 Jul 2017 03:22:07 GMT

Have you not tried it?

You may set "ip default-gateway <gw-IP>" to the internet gateway that connected through another interface than Gi0. For management connections, either set specific routes or use "ip route 0.0.0.0 0.0.0.0 <gw-IP-for-Gi0>"