topic Re: Switch Server RADIUS Config Post SP Node Addition in Network Access Control

Switch Server RADIUS Config Post SP Node Addition

aavnet89 — Tue, 20 Feb 2024 14:14:37 GMT

Good morning, good afternoon, good evening,

I am currently in the process of adding an additional Service Policy Node at a branch office, providing first response authentication, locally to site. This node is adopted and syncronising within the distrubted deployment.

Current switch configuration has the IP and ports of both the primary and secondary ISE nodes, with a seperate encrypted key for each configured responding RADIUS node. I wish to add the third SPN to the configuration, with an encrypted key. My question: Where in the ISE GUI can I add an *additional* RADIUS secret key on an already configured NAD?

Example config:

radius server ISE1
address ipv4 1.1.1.1 auth-port 1645 acct-port 1646
key 7 DSDSHJDJKSHAKDKSHKDLKHSAKLDASD

radius server ISE2
address ipv4 2.2.2.2 auth-port 1645 acct-port 1646
key 7 DSLKJUDJSALKDJSAJDLKi823797239871DS

radius server NEW-ISE3
address ipv4 3.3.3.3 auth-port 1656 acct-port 1646
key 7 ENTERNEWKEYHERE *add to ISE*

With thanks, in advance,

Alex

Re: Switch Server RADIUS Config Post SP Node Addition

ahollifield — Tue, 20 Feb 2024 17:05:42 GMT

Why not just use the same key? ISE supports up to two different keys for the same NAD but not three.

Re: Switch Server RADIUS Config Post SP Node Addition

aavnet89 — Wed, 21 Feb 2024 14:21:57 GMT

Thanks, ahollifield. An option, I have concidered.

To add context, the encrypted key as viewed on the NAD is different for each ISE node configured (primary and secondary respectively), i.e. switch1 has an encrypted key for ISE1 and an encrypted key for ISE2. When reviewing the ISE configuration via the GUI, a singular RADIUS key exists. Yet, both encrypted keys utilise two different hashes, those same hashed keys are configured identically across different switching infrastructure. Is this simply a case that the key (and password) has been hashed twice, and applied on multiple NADs?

Re: Switch Server RADIUS Config Post SP Node Addition

aavnet89 — Thu, 22 Feb 2024 08:08:17 GMT