Cisco ISE and RSA

[baker82]

Has anyone had any experience setting up a custom sdconf/sdopts.rec file point point various sites authentication traffic to their local RSA server?

I have a seven PSN node distributive deployment and each of these sites has their own RSA server. I would like to configure the sdopts.rec file to point the authentication traffic to their local sites RSA server. 

[rcullum]

Hi, we have just done something similar. You can load a unique sdopts.rec file per ISE node. Make sure you define the CLIENT_IP=<ISE Node ip address> as well at the start of the file. e.g:
CLIENT_IP=A.A.A.A
USESERVER=B.B.B.B,10
USESERVER=C.C.C.C,1

where USESERVER are the ip addresses for your RSA servers. The above means the first USESERVER entry is preferred as it has weighting of 10 and in theory, the weighting of 1 for the 2nd entry means it is only used if 1st entry is not available. You can 'load-balance' by making them both 10.