2 ISE radius groups CISCO Switches

[Richard Lucht]

We currently have a pair of ISE for network device access and authenticating VPN and Wireless.  Now this is for about 14000 users.  We plan on setting up a larger ISE deployment to use for authentication on the VPN and wireless as well as wired 802.1x and MAB.  I am looking for some help on setting up the aaa authentication servers

Now I have an ISE setup in the lab and I want to call it aaa group server radius B.  I want B to be the one to authenticate VPN, wireless and the wired.  Am I missing something the AAA settings and which setting would I use B?

aaa group server radius A
server name ISE3

aaa authentication login default group A local-case
aaa authentication dot1x default group A
aaa authorization console
aaa authorization exec default group A local
aaa authorization network default group A

[Francesco Molino]

Hi

Based on your output you'll need to create a new radius group and modify the aaa network and dot1x. However for doing wired dot1x, you'll need other configs. Do you need help on the other configs?

[Francesco Molino]

A pdf from Cisco that explain all commands for dot1x

[Richard Lucht]

Thank you, I will take a look at it tomorrow morning.