cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

375
Views
0
Helpful
2
Replies
Samuel Vuillaume
Cisco Employee

ISE Distributed - PSNs associated to Specific RSA Servers

Hey guys

Quick question.

I have been reading about this but I would like to get confirmation as it gets quite confusing lol

Anyway, my client has an ISE distributed env based on Dedicated PAN, Mnt and PSNs

They will be using many RSA servers as external identity sources.

Because of the distribution of the PSNs group of network devices (NAD group)   will be using specific PSNs and other group of NADs other  PSNs. 

Question:

—————

For specific groups of devices (NAD grouped per location for example) can they use a specific RSA server? As

PSN1—RSA1 primary

           |___RSA2 sec

PSN2—RSA2 primary

          |___RSA1 sec

This seems possible using rule based authentication policies in ISE.

However although it seems to be based on specific ISE  attributes only part of the ISE dictionary 

It seems we can group PSN together as a mode group.

So in this case I can def configure each NAD to point to specific “node group” then using rule based authentications asking these Node groups (based on device IP or device network group or location) to use a specific RSA servers.

If you could chime in I would appreciate.

Thank you

image1.jpeg

1 ACCEPTED SOLUTION

Accepted Solutions
hslai
Cisco Employee

Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.

If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.

View solution in original post

2 REPLIES 2
paul
Advocate

I don't think you can use node groups in Auth criteria, but just use the PSN hostname attribute:

Capture.JPG

hslai
Cisco Employee

Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.

If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.

View solution in original post

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel