ISE integration with Bluecoat SG

[mokabbar]

Team,

My customer wants to integrate ISE with their coming Bluecoat ASG proxy. The only task they need from ISE is to forward the username and IP address to Bluecoat so that it provides appropriate access based on those two parameters, noting that the same user might be accessing Internet from Internal LAN (using static proxy on Browser).

I thought we could use some sort of RADIUS for the communication, and read some documents on the internet but they were very vague

please advise

[Jason Kunst · Accepted solution]

We have no direct integration with bluecoat.  We could perhaps send syslog over to them and if they can glean it that way?

Not sure how the RADIUS would work as the clients authenticate against the network and then to ISE. Bluecoat is not in the equation

Bluecoat could certainly point to ISE for the users to authenticate again but don’t think they want that. Even better is ISE + WSA with PXGRID integration

[Jason Kunst]

You might want to also look into if Bluecoat supports SAML SSO integration? This might work for the employee side of things. For guests you will still have the same issue

[Shaik Moinuddin]

Hi Jason,

can you please provide some details about SAML SSO integration, actually our wireless users gets authenticated thru Cisco ISE (802.1X), after that we don't want them to enter their credentials again one more time for Bluecoat Proxy, but if they don't get authenticated in Bluecoat then we can't apply any proxy policies. i need your kimd help, please suggest.

thank you very much.

[Jason Kunst]

sorry i didn't see this. I would recommend reaching out to the ISE Product Marketing team as even with SSO they will still need to hit a portal before  authenticating.

https://communities.cisco.com/docs/DOC-64018#jive_content_id_Web_Portal_access_via_SAML_SSO