https://community.cisco.com/t5/network-access-control/vpn-users-authenticate-with-remote-psn/m-p/4089660#M560561 <P>When you say external RADIUS sequence what are you referring to?&nbsp; The VPN device should point to ISE as RADIUS servers and you should have multiple RADIUS definitions for redundancy.&nbsp; Do you have the HQ and remote PSN listed in the radius group on the VPN device?&nbsp;</P> <P>&nbsp;</P> <P>If you have both defined in the RADIUS group and the HQ device failed at some point the VPN device might have failed over to the remote PSN.&nbsp; Some network devices don't fail back to the first RADIUS servers in their list.&nbsp; They will keep using the same RADIUS server as long as it is working.&nbsp; Cisco WLCs by default don't fail back to the primary server in their list.</P> Wed, 20 May 2020 22:49:00 GMT paul 2020-05-20T22:49:00Z https://community.cisco.com/t5/network-access-control/vpn-users-authenticate-with-remote-psn/m-p/4088069#M560486 <P>When users VPN to the HQ with Anyconnect, they are authenticated to the remote office PSN.</P><P>I checked external radius for the sequence, it looks correct order check HQ first then the branch office.&nbsp; But it went directly to the branch office when VPN in.&nbsp; Office PC is able to login to the network with the HQ PSN.</P> Mon, 18 May 2020 17:13:52 GMT https://community.cisco.com/t5/network-access-control/vpn-users-authenticate-with-remote-psn/m-p/4088069#M560486 ironman28 2020-05-18T17:13:52Z https://community.cisco.com/t5/network-access-control/vpn-users-authenticate-with-remote-psn/m-p/4089660#M560561 <P>When you say external RADIUS sequence what are you referring to?&nbsp; The VPN device should point to ISE as RADIUS servers and you should have multiple RADIUS definitions for redundancy.&nbsp; Do you have the HQ and remote PSN listed in the radius group on the VPN device?&nbsp;</P> <P>&nbsp;</P> <P>If you have both defined in the RADIUS group and the HQ device failed at some point the VPN device might have failed over to the remote PSN.&nbsp; Some network devices don't fail back to the first RADIUS servers in their list.&nbsp; They will keep using the same RADIUS server as long as it is working.&nbsp; Cisco WLCs by default don't fail back to the primary server in their list.</P> Wed, 20 May 2020 22:49:00 GMT https://community.cisco.com/t5/network-access-control/vpn-users-authenticate-with-remote-psn/m-p/4089660#M560561 paul 2020-05-20T22:49:00Z