topic Re: Cisco ISE and Proxy PAC in Network Access Control

Cisco ISE and Proxy PAC

danielesquaranti — Tue, 16 Aug 2022 15:38:15 GMT

Hi,

I will want to understand if is possible to have a Policy that can assign a proxy pac to a client in Cisco ISE...

Someone would know how to answer?

Thanks

Re: Cisco ISE and Proxy PAC

balaji.bandi — Tue, 16 Aug 2022 16:41:16 GMT

Not sure, why not use WPAD if you looking to deploy Proxy PAC file.

https://www.cisco.com/c/en/us/td/docs/security/web_security/connector/connector3000/WPADAP.html

Re: Cisco ISE and Proxy PAC

thomas — Tue, 16 Aug 2022 17:39:10 GMT

I do not understand what you are trying to do. Please be very specific with your scenario.

RADIUS or TACACS?

What is the client that accepts PAC files from RADIUS or TACACS?

Do other AAA servers do this?

Re: Cisco ISE and Proxy PAC

danielesquaranti — Thu, 18 Aug 2022 07:24:45 GMT

I have a cisco ise policy which, for a certain condition, places client pc's on a vlan.
I want the http / https traffic of this vlan to be redirected to the proxy server. I have already tried with WCCP but for various reasons it is not implementable in my infrastructure ..
So I was looking for some other way to do this.

I use RADIUS.

Re: Cisco ISE and Proxy PAC

cnmyuxiaosheng — Thu, 18 Aug 2022 07:27:00 GMT

于我悠悠竟何有，
效颦常锁远山愁。
圣朝亦知贱士丑，
是恩是怨无性相。
婊里不一东瀛狗，
子规啼月小楼西。
养来鹦鹉觜初红，
的皪江梅浅浅春。

Re: Cisco ISE and Proxy PAC

thomas — Thu, 18 Aug 2022 20:38:30 GMT

No, wrong kind of redirection. ISE redirects all http traffic to an ISE web portal for the purposes of Guest authentication or BYOD enrollment.

ISE does network access control enforcement with VLANs, ACLs, SGTs, timers, and anything that can be set via RADIUS attributes on the *network device* to control the user/endpoint session. ISE does not assign/update/configure the endpoint OS or applications (browser) as part of the authorization.

ISE may assign them to a VLAN whose traffic is all routed through a proxy or web application server to the Internet. This would be very typical for Guest scenarios! But ISE does not configure web proxy PACs on the endpoint/browser itself.