PSNs with 2 interfaces for guest authentication

[umahar]

We have an ISE Guest cluster with PSNs having 2 interfaces.

One interface receives the radius request and the other interface receives the web redirected traffic.

WLC----internal-network-----PSN---------------router

During failover testing we shut down the router interface.

WLC was still sending radius request to the internal-network interface of PSN because it was still alive. Endpoints when getting redirected to the other interface of the PSN are getting dropped.

Is there a way for PSN to start dropping radius request on one interface if the second interface goes down ?

[Francesco Molino]

Hi Umahar

I'm sorry but what's your question?
I thing you're missing a part of your post.

[umahar]

oh ya, I thought my post was autosaved. Still getting used to the new interface :)

[Francesco Molino · Accepted solution]

Unfortunately there's no tracking feature to do so and that's why I always implement ISE with multiple interfaces but use anycast design. As you can't shutdown the interface because tracking isn't there and you don't have access to linux shell, radius packets still go through the default ISE interface and it will redirect endpoints to a anycast IP which means:

 - if interface 2 is down on ISE node 1, the routing will redirect the user to the same IP located on ISE node 2.

Do you follow me here?

Otherwise, for customers who have Load-balancers, they can achieve the same thing by returning LB VIP and LB will be in charge to redirect traffic to ISE node 1 or 2.

[hslai]

See also PSNs with 2 interfaces for guest authen... (by umahar on 08-01-2018 11:41 AM)

[hslai]

See also PSNs with 2 interfaces for guest authen... (by umahar on 08-01-2018 11:41 AM)