topic Re: ISE - OKTA as external radius server in Network Access Control

ISE - OKTA as external radius server

Madura Malwatte — Tue, 28 Jul 2020 15:19:05 GMT

Need some help to shed some light on the below errors.

I have Okta for MFA set up as an external radius server on ISE (i think here lies my problem, as other users on here have mentioned configuring Okta as radius token instead). I'll try radius token, but for now Okta is currently set up as an external radius server on ISE and I get an access reject back from Okta with the following error seen in the ISE radius live logs: "Authentication failed for user user@company.com, reason --- Access-Request failed, error: Request failed at step=DURING_MFA_POLL_LOOP. Time-out".. Anyone know what this MFA_POLL_LOOP timeout is?

In other instances I see this error in the live logs: "5405 RADIUS Request dropped - 11353 No more external RADIUS servers; can't perform failover"

Re: ISE - OKTA as external radius server

Madura Malwatte — Wed, 29 Jul 2020 06:56:05 GMT

I was able to get this working setting up Okta as a RADIUS Token Server on ISE. Not sure why RADIUS proxy doesn't work, must be the Okta side.

Re: ISE - OKTA as external radius server

Mustafa9046 — Fri, 05 Nov 2021 19:43:16 GMT

Hi Madura Malwatte,

I am trying to Add OKTA to ISE 3.0 as Radius Token server

I want to use OKTA for authentication on Device Admin and use AD for Authorization

Can you please me with some reference document or share some Steps/Screenshots ???

Re: ISE - OKTA as external radius server

hslai — Mon, 08 Nov 2021 16:40:46 GMT

Please follow one of the existing guides, that also use RADIUS token servers.

For example, How to Deploy ISE Device Admin with Duo MFA