cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
 
Register for the monthly ISE Webinars to learn about ISE configuration and deployment.
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

161
Views
0
Helpful
2
Replies
Highlighted
Cisco Employee

ISE Distributed - PSNs associated to Specific RSA Servers

Hey guys

Quick question.

I have been reading about this but I would like to get confirmation as it gets quite confusing lol

Anyway, my client has an ISE distributed env based on Dedicated PAN, Mnt and PSNs

They will be using many RSA servers as external identity sources.

Because of the distribution of the PSNs group of network devices (NAD group)   will be using specific PSNs and other group of NADs other  PSNs. 

Question:

—————

For specific groups of devices (NAD grouped per location for example) can they use a specific RSA server? As

PSN1—RSA1 primary

           |___RSA2 sec

PSN2—RSA2 primary

          |___RSA1 sec

This seems possible using rule based authentication policies in ISE.

However although it seems to be based on specific ISE  attributes only part of the ISE dictionary 

It seems we can group PSN together as a mode group.

So in this case I can def configure each NAD to point to specific “node group” then using rule based authentications asking these Node groups (based on device IP or device network group or location) to use a specific RSA servers.

If you could chime in I would appreciate.

Thank you

image1.jpeg

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: ISE Distributed - PSNs associated to Specific RSA Servers

Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.

If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.

2 REPLIES 2
VIP Engager

Re: ISE Distributed - PSNs associated to Specific RSA Servers

I don't think you can use node groups in Auth criteria, but just use the PSN hostname attribute:

Capture.JPG

Cisco Employee

Re: ISE Distributed - PSNs associated to Specific RSA Servers

Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.

If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.