topic Re: Use NAS-IP Address to look up network device in ISE instead of source address in Network Access Control

Use NAS-IP Address to look up network device in ISE instead of source address

rmueller@cisco.com — Fri, 12 Jul 2019 13:58:14 GMT

Hi all,

to my knowledge, currently ISE uses per default the source ip address of the RADIUS-request to look up the network device. This can cause issues if there are NAT-devices between the network access device and the ISE.

Is there a known way to use the NAS-IP address within the RADIUS-packet to look up the network device instead?

Roland

Re: Use NAS-IP Address to look up network device in ISE instead of source address

Francesco Molino — Sun, 14 Jul 2019 03:30:37 GMT

Hi

I believe you're talking about wired devices.
What devices' models are you using?

Here a link that might help:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_radatt/configuration/xe-16/sec-usr-radatt-xe-16-book/sec-rad-nas-ip-cfg.html

Re: Use NAS-IP Address to look up network device in ISE instead of source address

Arne Bier — Wed, 17 Jul 2019 23:42:37 GMT

Hi rmueller@cisco.com

Nope - the NAS-IP-Address is not used in ISE's inbound RADIUS packet processing. It's one of the reason's why Source NAT (SNAT) NAD breaks CoA, because ISE will never be able to perform the CoA to a device whose IP address has been source NAT'd. ISE can send the CoA out, but the NAD's reply will be a SNAT'd UDP packet ... ISE will think the ACK never arrived.

Craig Hyps famously had a phrase "SNAT for NAD is bad - SNAT for CoA is OK" - but you have to understand the IP packet flow to know what that means.