CoA Session Context not found with Citrix Netscaler and ISE

[Wacfteiner]

We have a 7 node deployment which consists of a PA/SA, PM/SM, 3 PSNs. 

ISE 2.7 patch 3

All nodes are size medium in a Nutanix environment

We first tried to manually define each switch to manually load balance our PSNs by defining only two PSNs on each switch and mixing it up evenly by device load. This did not prove efficient so we moved to a citrix Netscaler for load balancing.

We are consistently seeing CoA Session Context not found errors. I have worked extensively with TAC and collected logs and packet captures at the PSNs. Tac is confident this is an issue with the netscaler but this isnt Ciscos preferred netscaler.

Does anyone have some guidance to provide to make sure we are doing this properly?

[craig.beck · Accepted solution]

The PSN will send a CoA packet from source-port 1700 which needs to be source-NAT'ed through the NetScaler to the VIP address. I suspect the CoA packet is coming from the real PSN address.

As an example, if you have 1 RADIUS server defined on the switch because you have 1 VIP, like this:

radius server PSN-VIP
 address ipv4 10.10.10.1 auth-port 1812 acct-port 1813
 key presharedkey
!
aaa group server radius RADIUS-VIP
 server name PSN-VIP
!
aaa server radius dynamic-author
 client 10.10.10.1 server-key 0 presharedkey

...you list the VIP address as a dynamic author client, and CoA should work if you SNAT traffic from PSNs on port 1700.

Can you show us your switch config, please, if it is different to the above?