topic Re: 2 ISE radius groups CISCO Switches in Network Access Control

2 ISE radius groups CISCO Switches

Richard Lucht — Fri, 21 Feb 2020 18:37:04 GMT

We currently have a pair of ISE for network device access and authenticating VPN and Wireless. Now this is for about 14000 users. We plan on setting up a larger ISE deployment to use for authentication on the VPN and wireless as well as wired 802.1x and MAB. I am looking for some help on setting up the aaa authentication servers

Now I have an ISE setup in the lab and I want to call it aaa group server radius B. I want B to be the one to authenticate VPN, wireless and the wired. Am I missing something the AAA settings and which setting would I use B?

aaa group server radius A
server name ISE3

aaa authentication login default group A local-case
aaa authentication dot1x default group A
aaa authorization console
aaa authorization exec default group A local
aaa authorization network default group A

Re: 2 ISE radius groups CISCO Switches

Francesco Molino — Thu, 26 Oct 2017 00:35:26 GMT

Hi

Based on your output you'll need to create a new radius group and modify the aaa network and dot1x. However for doing wired dot1x, you'll need other configs. Do you need help on the other configs?

Re: 2 ISE radius groups CISCO Switches

Francesco Molino — Thu, 26 Oct 2017 00:42:41 GMT

A pdf from Cisco that explain all commands for dot1x

Re: 2 ISE radius groups CISCO Switches

Richard Lucht — Thu, 26 Oct 2017 02:14:03 GMT

Thank you, I will take a look at it tomorrow morning.