This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC!
We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
Hey guys
Quick question.
I have been reading about this but I would like to get confirmation as it gets quite confusing lol
Anyway, my client has an ISE distributed env based on Dedicated PAN, Mnt and PSNs
They will be using many RSA servers as external identity sources.
Because of the distribution of the PSNs group of network devices (NAD group) will be using specific PSNs and other group of NADs other PSNs.
Question:
—————
For specific groups of devices (NAD grouped per location for example) can they use a specific RSA server? As
PSN1—RSA1 primary
|___RSA2 sec
PSN2—RSA2 primary
|___RSA1 sec
This seems possible using rule based authentication policies in ISE.
However although it seems to be based on specific ISE attributes only part of the ISE dictionary
It seems we can group PSN together as a mode group.
So in this case I can def configure each NAD to point to specific “node group” then using rule based authentications asking these Node groups (based on device IP or device network group or location) to use a specific RSA servers.
If you could chime in I would appreciate.
Thank you
Solved! Go to Solution.
Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.
If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.
I don't think you can use node groups in Auth criteria, but just use the PSN hostname attribute:
Paul is correct that PSN node groups are not available as authentication policy conditions and they are more for ISE profiling replications.
If you meant network devices in the same network device groups use the same sets of PSNs, then you may use the network device grouping as the authentication policy conditions.