topic Re: Cisco ISE and Extended NAS-Port-Type Support in Network Access Control

Cisco ISE and Extended NAS-Port-Type Support

rezaalikhani — Mon, 23 Oct 2023 06:04:59 GMT

Hi all;

Does ISE support Extended NAS-Port-Type by default?

Thanks

Re: Cisco ISE and Extended NAS-Port-Type Support

MHM Cisco World — Mon, 23 Oct 2023 06:58:59 GMT

I see NAS-port-type attribute 61 list in ISE.

Re: Cisco ISE and Extended NAS-Port-Type Support

rezaalikhani — Mon, 23 Oct 2023 08:08:49 GMT

Yes, ISE supports RADIUS Attribute 61, but as I said, I want to know about Extended NAS-Port-Type.

Re: Cisco ISE and Extended NAS-Port-Type Support

Greg Gibbs — Tue, 24 Oct 2023 00:09:59 GMT

There is no separate Dictionary in ISE for Extended NAS-Port-Type. The built-in RADIUS dictionary supports various IETF attributes, including NAS-Port-Type (Attribute 61), and multiple relevant standard values.

To determine if ISE supports your use case, we would need more details, such as:

What specific RADIUS Attribute/Value pair are looking to support?
Is there an IETF/RFC standard that describes this AV pair?
Is the network device capable of sending this information to ISE via RADIUS authentication/accounting?

Re: Cisco ISE and Extended NAS-Port-Type Support

thomas — Tue, 31 Oct 2023 00:34:08 GMT

ISE 3.3 lists the following values in the Policy Sets Condition Studio editor for RADIUS:NAS-Port-Type :
ADSL-CAP
ADSL-DMT
Async
Cable
Ethernet
FDDI
G.3 Fax
HDLC Clear Channel
IAPP
IDSL
ISDN Async V.110
ISDN Async V.120
ISDN Sync
PIAFS
SDSL
Sync
Token-Ring
Virtual
Wireless - 1X-EV
Wireless - CDMA2000
Wireless - IEEE 802.11
Wireless - Other
Wireless - UMTS
X.25
X.75
xDSL

The RADIUS RFC-2865 lists only the following for NAS-Port-Type values:

      0       Async
      1       Sync
      2       ISDN Sync
      3       ISDN Async V.120
      4       ISDN Async V.110
      5       Virtual
      6       PIAFS
      7       HDLC Clear Channel
      8       X.25
      9       X.75
      10      G.3 Fax
      11      SDSL - Symmetric DSL
      12      ADSL-CAP - Asymmetric DSL, Carrierless Amplitude Phase Modulation
      13      ADSL-DMT - Asymmetric DSL, Discrete Multi-Tone
      14      IDSL - ISDN Digital Subscriber Line
      15      Ethernet
      16      xDSL - Digital Subscriber Line of unknown type
      17      Cable
      18      Wireless - Other
      19      Wireless - IEEE 802.11

So ISE definitely supports some of the non-RFC extended attributes.

There are some additional non-RFC compliant broadband service port types with their corresponding values documented in Extended NAS-Port-Type and NAS-Port Support that ISE does not support:

Service Port Type | RADIUS Value
PPPoA             | 30
PPPoEoA           | 31
PPPoEoE           | 32
PPPoEoVLAN        | 33
PPPoEoQinQ        | 34

If you need more extended NAS-Port-Type values in the ISE Conditions Studio, please Make a Wish @ https://cs.co/ise-wish and be very explicitly about which extended attributes, the values, and your public source for this information.

Re: Cisco ISE and Extended NAS-Port-Type Support

rezaalikhani — Tue, 31 Oct 2023 09:38:09 GMT

Thanks for your great answer!