PEAP/EAP RADIUS Failure Behind F5 VIP with Cisco ISE and Meraki

[vishnuvardhan-gollapudi]

Working on PEAP Authentication with PSNs behind the F5 Load Balancer

Current Setup:

• Client Flow:
  Wireless Client → Meraki SSID (802.1X with PEAP)
  Meraki Switch → Core Switch → F5 Load Balancer (BIG-IP)
• F5 Configuration:
  VIP (RADIUS): 10.1.1.220:1812 (No SNAT)
  F5 Internal Self-IP: 10.2.2.30
  Load balancing RADIUS traffic to:
  • PSN1: 10.2.2.41
  • PSN2: 10.2.2.42
    Persistence configured via iRule (following Cisco + F5 ISE Load Balancing Guide)
• Cisco ISE PAN: 10.1.1.43

Issue:

When the Meraki SSID sends RADIUS traffic to the F5 VIP, PEAP authentication fails with:

• ISE Logs: 12930 / 5411 – "Supplicant stopped responding to ISE"
• ISE shows the first packet lands on one PSN, but the next EAP step doesn’t come back

However, if I configure Meraki to point directly to either PSN1 or PSN2, PEAP works flawlessly — the full EAP exchange stays on the same PSN.

Looking for Guidance:

Has anyone successfully configured F5 load balancing for PEAP RADIUS traffic from Meraki and managed to maintain EAP session persistence?

Any insights or tips are much appreciated! I'm happy to share the final working config with the community once resolved.

[Marcelo Morais]

Hi @vishnuvardhan-gollapudi ,

 have you checked if the problem is " ... the next EAP step doesn’t come back ... " or if the 1st EAP Response from ISE did not reach Meraki ?

Regards

[vishnuvardhan-gollapudi]

I did a packet capture using Wireshark the RADIUS request from the Meraki switch is definitely reaching the F5 VIP. I also confirmed that the same request is visible between the Meraki switch and ISE directly

 However, when going through F5, the traffic doesn’t reach the PSNs (ISE nodes). I only see F5 sending health check probe pings to the PSNs, but no actual RADIUS traffic.

Appreciate any further insights.

Please go through this images

[vishnuvardhan-gollapudi]

[andrewswanson]

Hi

Have you tried changing your persistence from rule based to simple "source IP" as a test?

hth
Andy

[vishnuvardhan-gollapudi]

Yes, I did try changing the persistence to use the NAS IP address, but unfortunately, it still didn’t work. The issue with PEAP session continuity remained.

[Marcelo Morais]

Hi @vishnuvardhan-gollapudi ,

 you said " ... the traffic doesn’t reach the PSNs (ISE nodes) ... ", if F5 was sending the packet to the wrong PSN, then the "Persistence Rule" would be the next step to investigate (already mentioned by @andrewswanson ), but it seems that F5 is not sending the packet to any PSN ... could you please check where F5 is sending the packet ?

Hope this helps !!!

[vishnuvardhan-gollapudi]

Yes, I ran a packet capture using Wireshark to trace the flow.

From what I observed:

1. The Meraki switch (10.1.1.293) is sending the RADIUS Access-Request to the F5 VIP (10.1.1.220).

2. Separately, I also see the Meraki switch directly hitting PSN1 (10.2.2.41)

[Marcelo Morais]

@vishnuvardhan-gollapudi ,

 OK about 1. and 2., but what about the F5 VIP sending the RADIUS Access-Request to ISE ?

[vishnuvardhan-gollapudi]

The F5 VIP is not sending the RADIUS Access-Request to ISE at all. In my setup, the F5 internal interface (10.2.2.30) is added as a NAD in ISE , so any traffic from F5 to the PSNs would appear as coming from that IP.

However, on the ISE side, I’m only seeing the health check probe traffic with the default username f5-probe. There are no actual RADIUS Access-Requests coming from the VIP to the PSNs.

[Marcelo Morais]

@vishnuvardhan-gollapudi ,

 got it !!!

 What happens if you only add one PSN to your F5 setup (instead of two PSNs) ? Still the same issue ?

[vishnuvardhan-gollapudi]

Yes, I tested that as well.

I disabled one PSN in the F5 pool and even powered off the same PSN to ensure all traffic goes to a single PSN, but the issue still persists. F5 still doesn't forward the RADIUS request to the active PSN.

[vishnuvardhan-gollapudi]

This is what i got when i check the F5 console

This what i got in ISE

[MHM Cisco World]

Use either wildcard Cert. Or add SAN to cert. Of PSN1.

Issue is client dont accpet cert. Of PSN.

MHM

[anu-fatokun]

I'm facing similar issue....same scenario. Can you please expatiate how to do this. My setup is done as in the picture below. when I add the PSNs to the PAN, the certificates were imported to PAN. Since the PSNs are managed via the PAN, is your solution applicable in this case. Am i changing the PSNs certificate or the PAN?