Authenticate from NAT outside endpoint

[azhakama]

I want to confirm if it is possible to authenticate from NAT inside endpoints but also from outside endpoints(which have Global IP address).

It seems to work if ISE is Static NATed, but is it supported structure?

                                                                          Outside<- | ->Inside

Global IP address endpoints --- GW(Global IP)-----| NAT Router |---- ISE(Static NATed) |----- Private IP address endpoints(PATed)

[Jason Kunst · Accepted solution]

NNot officially tested but has been working for years

[azhakama]

Thank you for the reply. Could you kindly tell me what type of authentication is used ?

My customer's environment is going to be MAB, Web Auth, dot1x mixed. These are on Wired and Wireless.

And in the future, they are planning to use Dynamic VLAN, Downloadable ACL or Trustsec.

It still seems working fine when ISE is Static NATed, however, please let me know if there is any known issue.