ISE and DTLS and ISE as PROXY

[mverbon]

Hi all,

One of my customers wants to secure the Radius communication between 2 ISE environments.

ISE1 is configured as the Radius Server, the ISE PROXY is configured here as Network Device.

ISE2 is configured as the Radius PROXY.

Running both version 2.2, DTLS is an option to use.

Disabled, Cisco ISE will process both UDP and DTLS requests from the Network Device.

Enabled,  Cisco ISE will process only the DTLS requests from the Network Device.

So this is possible to configure in environment ISE1.

Environment ISE2 is configured as PROXY.

There is no option to configure anything in ISE2 regarding DTLS and the External Radius Servers configuration.

Does this mean DTLS is not going to work in this situation?

Or is DTLS negotiated between the ISE1 Radius Server and the ISE2 Radius Proxy?

Thanks in advance

Best regards,

Martin

[smashash · Accepted solution]

ISE as proxy in DTLS flow is not supporting today.

Please reach out to ISE-pm through sales for a feature request

[mverbon]

Hi Salomon,

Thanks for the information.

Best regards,

Martin