cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

599
Views
0
Helpful
1
Replies
Wacfteiner
Beginner

CoA Session Context not found with Citrix Netscaler and ISE

We have a 7 node deployment which consists of a PA/SA, PM/SM, 3 PSNs. 

ISE 2.7 patch 3

All nodes are size medium in a Nutanix environment

 

We first tried to manually define each switch to manually load balance our PSNs by defining only two PSNs on each switch and mixing it up evenly by device load. This did not prove efficient so we moved to a citrix Netscaler for load balancing.

 

We are consistently seeing CoA Session Context not found errors. I have worked extensively with TAC and collected logs and packet captures at the PSNs. Tac is confident this is an issue with the netscaler but this isnt Ciscos preferred netscaler.

 

Does anyone have some guidance to provide to make sure we are doing this properly?

1 ACCEPTED SOLUTION

Accepted Solutions
craig.beck
Beginner

The PSN will send a CoA packet from source-port 1700 which needs to be source-NAT'ed through the NetScaler to the VIP address. I suspect the CoA packet is coming from the real PSN address.

 

As an example, if you have 1 RADIUS server defined on the switch because you have 1 VIP, like this:

 

radius server PSN-VIP
 address ipv4 10.10.10.1 auth-port 1812 acct-port 1813
 key presharedkey
!
aaa group server radius RADIUS-VIP
 server name PSN-VIP
!
aaa server radius dynamic-author
 client 10.10.10.1 server-key 0 presharedkey

...you list the VIP address as a dynamic author client, and CoA should work if you SNAT traffic from PSNs on port 1700.

 

Can you show us your switch config, please, if it is different to the above?

View solution in original post

1 REPLY 1
craig.beck
Beginner

The PSN will send a CoA packet from source-port 1700 which needs to be source-NAT'ed through the NetScaler to the VIP address. I suspect the CoA packet is coming from the real PSN address.

 

As an example, if you have 1 RADIUS server defined on the switch because you have 1 VIP, like this:

 

radius server PSN-VIP
 address ipv4 10.10.10.1 auth-port 1812 acct-port 1813
 key presharedkey
!
aaa group server radius RADIUS-VIP
 server name PSN-VIP
!
aaa server radius dynamic-author
 client 10.10.10.1 server-key 0 presharedkey

...you list the VIP address as a dynamic author client, and CoA should work if you SNAT traffic from PSNs on port 1700.

 

Can you show us your switch config, please, if it is different to the above?

View solution in original post

Content for Community-Ad