topic Re: ISE normalized radius vs radius attributes in Network Access Control

ISE normalized radius vs radius attributes

Maurice Ball — Thu, 02 Apr 2020 09:03:21 GMT

What is the difference between an ISE normalized radius attribute vs an ISE radius attribute?

Re: ISE normalized radius vs radius attributes

gurbinder.kabbay — Thu, 02 Apr 2020 09:06:23 GMT

please check below link, it might help you.

https://community.cisco.com/t5/network-access-control/use-cases-for-various-radius-attributes-in-cisco-ise/m-p/3847935

Thanks

Garry

Re: ISE normalized radius vs radius attributes

Maurice Ball — Thu, 02 Apr 2020 11:28:11 GMT

I do not see the answer to my question in the post listed below.

Re: ISE normalized radius vs radius attributes

Mike.Cifelli — Thu, 02 Apr 2020 13:08:46 GMT

They represent separate attributes that you can reference as conditions in your ISE policies. The breakdown of attributes for radius vs normalized radius attributes is covered perfectly here:
https://community.cisco.com/t5/security-documents/ise-network-access-attributes/ta-p/3616253#toc-hId--26278376
HTH!

Re: ISE normalized radius vs radius attributes

Maurice Ball — Fri, 03 Apr 2020 07:58:28 GMT

The following is what I needed to know. Here is a great answer provided by Arne Bier.

Re: Use Cases for various RADIUS Attributes in Cisco ISE

Hi @Maurice Ball

A Normalised RADIUS attribute in ISE is a convenient abstraction that allows us to use a common attribute in our Policy Set Logic in a multi-vendor environment. E.g. if you have a mix of Cisco and Aruba WLC's, then you can either do it the hard way, by checking for the vendor specific attributes used, e.g. Cisco uses attribute Called-Station-ID for the SSID, and Aruba uses Aruba-Essid-Name. Perhaps a bad example, because I am no Aruba guru 😉 - but you get the point. There are other instances where vendor A signals a MAB Auth request with Service-Type = "Call-Check" and another vendor uses Service-Type = "Blah". Cisco ISE has multi-vendor support, and as long as you set the NAS with the correct Device Vendor Type ("Device Profile") then ISE does the internal mapping for you. Then you can use abstractions like Normalised Radius SSID which is vendor agnostic. You no longer need to care how it works under the hood.

Other abstractions are things like the Compound Conditions like Wireless_8021X and Wired_802.1X - have a look at those in detail and you can see that each vendor does it slightly differently.