Forward ISE RADIUS authentication and accounting messages

[joarcidi]

Hi All. I have a customer that may be hitting CSCvd83297. Their need is to have ISE see the accounting messages but also forward the authentication to RSA as well as send the accounting record over to another home grown server. The mentioned enhancement request seems to affect ISE v2.2(0.471). The customer needs to be able to see the actual RADIUS messages and not syslog messages. Does anyone know if this feature has been implemented in ISE v2.3 patch 2? Thanks in advance for any info.

[Arne Bier · Accepted solution]

Hi Joseph

Is your ISE PSN processing the Radius Authentication requests too?  If yes, then you cannot have your cake and eat it :-(  ISE can proxy radius auth/acct traffic to an external radius server, but then ISE does not process the authentication request - it just proxies the request to an external server and the external server processes Authentication and replies Access-Accept/Reject to ISE.  I stand to be corrected, but that is how I understand it.  It would be nice to have a way to say "if you receive accounting requests from NAD x, then also proxy this request to client y". The proxy (ISE) then effectively becomes a NAD in that case, and will be able to process the Radius Accounting ACKs.  Service provider products like Cisco Prime Access Registrar do that sort of thing easily.

It would be nice to have this feature (I agree) and in the end I had to use the F5 LTM to replicate the Radius Accounting traffic (we send our Radius auth/acct to an F5 Virtual Server and that has the smarts to do just about anything). 

[joarcidi]

Hi Arne,

Yes, you are correct. The PSN would be processing the RADIUS authentication request as well. It's unfortunate ISE doesn't support this feature at the moment but I appreciate the detailed answer. Thanks!