topic Re: Cloud based virtual machine dot1x authentication with Cisco ISE in Network Access Control

Cloud based virtual machine dot1x authentication with Cisco ISE

sumjoy_vicky — Wed, 18 Jan 2023 10:17:49 GMT

Hi All,

I would like to understand if virtual machine hosted on cloud (Azure, AWS etc) can authenticate through Dot1X or MAB by on premise Cisco ISE?

Thank You.

Re: Cloud based virtual machine dot1x authentication with Cisco ISE

balaji.bandi — Wed, 18 Jan 2023 11:44:42 GMT

YES / NO depends how the connection extended and is the NAD/NAC uses on prem ISE ?

Re: Cloud based virtual machine dot1x authentication with Cisco ISE

sumjoy_vicky — Wed, 18 Jan 2023 12:33:12 GMT

Yes, on-prem NAD/NAC are using on-prem ISE.

Re: Cloud based virtual machine dot1x authentication with Cisco ISE

Rodrigo Diaz — Wed, 18 Jan 2023 14:43:22 GMT

Hi @sumjoy_vicky , yes it's possible all will depend mostly in how the authentication will take place between ISE and NAD, as the ISE doesn't have direct contact with your PC but through your NAD , so if there is communication between PC and NAD , ISE will see it as normal authentication from a physical PC.

Let me know if that helped you .

Re: Cloud based virtual machine dot1x authentication with Cisco ISE

sumjoy_vicky — Thu, 19 Jan 2023 07:49:17 GMT

Thanks @Rodrigo Diaz for your response. I believe in this case NAD will be Vnet (on cloud) that can configure radius server pointing to on-prem ISE and extend radius server communication over S2S VPN between cloud and on-prem. Wondering if can add cloud VNET under network devices in on-prem ISE?

Thanks.

Re: Cloud based virtual machine dot1x authentication with Cisco ISE

Rodrigo Diaz — Thu, 19 Jan 2023 16:59:31 GMT

hey @sumjoy_vicky , for your scenario the addition of NAD would be the same from the ISE point of view , and ISE will handle the NAD as any other one within your environment and will reply to radius request your NAD generates , the point here is that some functionalities depending upon your NAD will not be supported , I would check these links for your reference :

https://www.cisco.com/c/en/us/td/docs/security/ise/nad_capabilities/nad_capabilities_with_ise.html

https://community.cisco.com/t5/security-knowledge-base/for-download-radius-vendor-dictionaries-for-3rd-parties/ta-p/3743448