topic Re: Query on IPS Authentication with CISCO ISE in Network Access Control

Query on IPS Authentication with CISCO ISE

kirubashankarr — Mon, 02 Aug 2021 20:22:26 GMT

Hello ,

We have an entire subnet onboarded for TACACS authentication and within that subnet we have IPS devices which requires a RADIUS authentication.

Version and patch : V 2.4.0.357 Patch 13

Query :

Is it possible to have RADIUS authentication enabled for the IPS device which comes within the subnet and which is already onboarded in ISE for TACACS authentication.
If yes do I need to onboard the IPS devices separately?
If I onboard the IPS separately will ISE allow me to Onboard the devices? since it is already a part of the subnet and will it consider to be a duplicate one?

Example :

Subnet onboarded for ISE TACACS is 10.2.2.0/24 , IPS IP's are 10.2.2.2 and 10.2.2.3.

Now I need to onboard the IPS devices10.2.2.2 and 10.2.2.3 (RADIUS Authentication) but 10.2.2.0/24 is already in ISE for TACACS authentication.

Kindly help me with this scenario.

Re: Query on IPS Authentication with CISCO ISE

Amine ZAKARIA — Mon, 02 Aug 2021 21:45:56 GMT

Hello,

1.Is it possible to have RADIUS authentication enabled for the IPS device which comes within the subnet and which is already onboarded in ISE for TACACS authentication. Yes it's possible

2.If yes do I need to onboard the IPS devices separately? Again yes you should create a network device for these 2 ips as /32 for radius with the preshared key.

3.If I onboard the IPS separately will ISE allow me to Onboard the devices? since it is already a part of the subnet and will it consider to be a duplicate one? In your case ISE will not complain about the duplication creation as long as the NAD will be declared as /32.

Hope that helps!

Re: Query on IPS Authentication with CISCO ISE

thomas — Wed, 04 Aug 2021 18:27:11 GMT

RADIUS and TACACS are separate protocols supported by ISE.

You may individually enable each protocol per device or device subnet under Administration > Network Resources > Network Devices:

To "onboard" the devices for RADIUS you would simply check the box in your device subnet configuration in ISE as shown above and provide the RADIUS shared secret similar to what you did with TACACS.