ISE Distributed - PSNs associated to Specific RSA Servers

[Samuel Vuillaume]

Hey guys

Quick question.

I have been reading about this but I would like to get confirmation as it gets quite confusing lol

Anyway, my client has an ISE distributed env based on Dedicated PAN, Mnt and PSNs

They will be using many RSA servers as external identity sources.

Because of the distribution of the PSNs group of network devices (NAD group)   will be using specific PSNs and other group of NADs other  PSNs. 

Question:

—————

For specific groups of devices (NAD grouped per location for example) can they use a specific RSA server? As

PSN1—RSA1 primary

           |___RSA2 sec

PSN2—RSA2 primary

          |___RSA1 sec

This seems possible using rule based authentication policies in ISE.

However although it seems to be based on specific ISE  attributes only part of the ISE dictionary 

It seems we can group PSN together as a mode group.

So in this case I can def configure each NAD to point to specific “node group” then using rule based authentications asking these Node groups (based on device IP or device network group or location) to use a specific RSA servers.

If you could chime in I would appreciate.

Thank you

[paul]

I don't think you can use node groups in Auth criteria, but just use the PSN hostname attribute:

[hslai · Accepted solution]

Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.

If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.