Cisco ISE - TACACS Authentication

[M Talha]

Hi All,

I have deployed ISE behind F5 load balancer and currently facing issue with respect to TACACS authentication request coming into ISE. I can only see request coming from LB self IP's in TACACS logs and not the actual IP. Any suggestions on how it can be fixed.

[Rob Ingram]

@M Talha ISE uses the device’s Layer 3 IP address to identity the NAD, are you using SNAT for the incoming TACACS requests?

Refer to the ISE F5 load balancer guide - https://community.cisco.com/t5/security-knowledge-base/how-to-cisco-amp-f5-deployment-guide-ise-load-balancing-using/ta-p/3631159

[M Talha]

No without using SNAT.

[Flavio Miranda]

@M Talha 

This guide is related to Radius, but I believe it can help you with TACACS also.

Basically, you need to create two VIPs IP forwarding for inbound and outbound.

How To: Cisco & F5 Deployment Guide: ISE Load Balancing Using BIG-IP - Cisco Community

[M Talha]

Yes that guide is more specific with radius and VIPs are created in similar way.

[ahmadkhan012514]

Have you found any way?

[M Talha]

Not yet

[MHM Cisco World]

the ISE IP must not appear, only LB VIP will be use