ISE forwarding MAB Request to External Radius Server

[Aditya Gupta]

Hello Experts,

We are in middle of PoC for one of our customers with following requirement:

**Requirement**

Initially End User MAB should be authenticated by ISE Internal Database if mac address not found than the request needs to be sent & authenticate with external radius server (Mac server)

We Tried following:

Case -1 - If we Use external radius server configuration in ISE – ISE will relay all the request to External radius server it will not check internal database.

Case -2 - If we Use radius token server configuration in ISE – ISE will check its internal database and send the request to the radius token server but in that case ISE will change the mac address format.

            i.e. – ISE gets the request from the user with the mac address 1ad232dc2af4 and when ISE send the request to Radius token server it will change mac to 1A:D2:32:DC:2A:F4 but in Radius server database we have mac in this format1ad232dc2af4, So the response we get is “User Not Found”

please suggest if there is any other way to make customization on Cisco ISE

Thank you for your help.

Aditya Gupta

[kvenkata1]

Radius Proxy & Radius token are the two ways to integrate external radius servers. In the Token option there is no possibility to customize the attributes. Please see Craig's response on this question.

Re: What attributes can we send from ISE to an external radius authentication servers

- Krish

[kthiruve · Accepted solution]

Please try this in advance attribute setting of ISE when you configure external Radius server and add it to Radius server sequence on the top. Hoping that the end point mac address is the calling station ID you are referring.

Thanks

Krishnan