cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

76
Views
0
Helpful
1
Replies
Highlighted
Cisco Employee

External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs

Hi team,

 

I am having a hard time to solve a design issue. There are two companies who have a direct connection between them and time to time the employees move between the companies. Both of the companies are using ISE and have their ADs, Wired/Wireless NAC is also in place. Request is to have the User A from Company A to be able to Authenticate with his credentials on Company B's NADs and same the other way. I am trying to understand the possibility of External RADIUS Server as they don't want to have the Multi-AD integration. If I create a rule with RADIUS Sequence as far as I understand from the document, it will try the first ISE then if it doesn't receive a response, it will move on to the next-one. But how about the RADIUS-Reject scenario? Do we try each RADIUS Servers till we have RADIUS-Accept or finish all the RADIUSes or first time we receive a RADIUS-Reject we stop the process completely? Or how can I achieve the granularity on Authentication Policy based on the company that user belongs to?

 

Any response or guidance will be much appreciated!

 

Regards,
Efe

 

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
VIP Advocate

Re: External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs

I would do the following:

 

  1. Company A defined Company B's ISE PSNs as an external RADIUS token server in their ISE deployment.
  2. Company A defined an identity source sequence that checks Company A AD then Company B external RADIUS server.
  3. Company B does the reverse of that.

The only danger in that setup is if an AD account with the exact same name exists in Company A AD for a Company B user, but hopefully that risk should be minimal

View solution in original post

1 REPLY 1
Highlighted
VIP Advocate

Re: External RADIUS Server Sequence Fallback RADIUS-Reject Design Qs

I would do the following:

 

  1. Company A defined Company B's ISE PSNs as an external RADIUS token server in their ISE deployment.
  2. Company A defined an identity source sequence that checks Company A AD then Company B external RADIUS server.
  3. Company B does the reverse of that.

The only danger in that setup is if an AD account with the exact same name exists in Company A AD for a Company B user, but hopefully that risk should be minimal

View solution in original post