multi LNS server IP balanced by ISE response

[Weiborao]

Hi, Dear ISE Experts

My customer have L2TP authentication requirement, need ISE to return LNS server IP to LAC. Customer have multiple LNS servers, hope ISE can return LNS server IP with round robin. Does ISE support it?

If not support round robin, does ISE support returning multiple LNS IP addresses to the LAC ?

BTW, all LAC authentication will use same user name with no password.(or we can say no authentication required)

Thanks

[Weiborao]

Hi Jason

Yes you are right.

I am working with David Li, who is the local Security Expert in China Team.

I think it is the LAC that decide how to load-balancing between the LNS addresses returned from the attribute 67.

67

Tunnel-Server-Endpoint

IP address of the LNS that establishes a tunnel. The IP address is in dotted decimal notation. A tag can deliver a maximum of eight IP addresses, with each IP address separated by a space. Multiple IP addresses work in primary/secondary mode.

[hslai · Accepted solution]

Please consult with the support teams for the network device platform as to the specifics to return from a RADIUS server.

For instance, VPDN Configuration Guide, Cisco IOS Release 12.4 - Configuring AAA for VPDNs [Cisco IOS Software Releases 12.4 Mainline] - Cisco mentions to use either Cisco VSA (cisco-av-pair) or RADIUS tunnel attributes. The examples I found are all using very old ACS releases, but I believe they would be similar to the following ISE authorization profiles.

[Weiborao]

Hi, hslai

Thank you very much for you reply and contribution.