PSN behind ASA fw

[pmlam3274]

Having some problem getting the switch to authenticate with dot1x.  Currently we have a PSN behind a cisco Asa fw and the switch IP address is statically nat to an outside IP address.  All port are open both inside and outside (testing purpose).  Does anyone know if the nat translation of an NAS ip address have any affect how ise process the information from the switch?  

[nspasov]

Please reference the link below that shows all of the ports used by Cisco ISE. 

http://www.cisco.com/c/en/us/td/docs/security/ise/1-4/installation_guide/b_ise_InstallationGuide14/b_ise_InstallationGuide14_appendix_01010.html

As far as NAT: make sure that your DNS is set up properly to ensure that the ISE serves resolve correctly as that becomes important for users/endpoints being redirected to ISE for guest, posture and client-provisioning. 

I hope this helps!

Thank you for rating helpful posts!