Radius Attribute forwarding in ISE

[a.ascione]

Hello

I'm trying to forward a radius attribute (cisco-ip-pool-definition)  from an external identity source to my CISCO ASA vpn device.

I can see in the TCP Dump that the attribute is received from my external Radius server,

but I  am not able to create an authorization policy that matches and forwards this attribute.

In the configuration of the External Identity source, in the authorization tab I have Cisco.Secure.ID.

How can  I match this attribute in an authorization policy ?

Thanks in advance for your help

[Arne Bier]

Oh this is a classic. I had the same problem and the solution is not documented by Cisco anywhere.

Here is the answer:

Your external radius server has to return a new CiscoAVPair attribute in the format:

CiscoAVPair:ACS:cisco-ip-pool-definition

The key thing in that Cisco AVPair is the prefix 'ACS' ... yes. I died laughing too...

The final value shown above (cisco-ip-pool-definition) can be replaced with anything and it does not relate to any IETF radius attribute - it's just a label.  Just make sure that the label is the same as the value you enter into the Authorization Tab under Radius Token Identity Services in ISE GUI.

Let's say your Radius Token Identity Service is called EXTRADIUS, then in your actual Policies, you will refer to the returned value as

EXTRADIUS:cisco-ip-pool-definition

cheers