- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-16-2019 12:32 AM
Hi There,
There is an option on ISE where it could be used as a radius proxy server.
I am quite curious what could be such use case where this could be implemented?
Could you please list and explain such use cases?
Thank you
Solved! Go to Solution.
- Labels:
-
Identity Services Engine (ISE)
Accepted Solutions

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-16-2019 05:34 AM
Are you asking when to use RADIUS proxy vs. RADIUS token server setup? Or just why would you send request to another RADIUS server?
If you are asking the first one basically it boils down to being able to pass back all the attributes from the external RADIUS server. When you use a RADIUS proxy setup all AV pairs handed back from the RADIUS server are sent back to the client. If you use a RADIUS token server setup you can select on attribute to receive back from the external RADIUS server. I prefer the RADIUS token server setup as it looks like any other identity source. In most cases I don't need any attributes coming back from the external RADIUS server.
As to why you would use an external RADIUS server the most common use case is MFA/2FA. You are passing the authentication over to an external MFA/2FA RADIUS server to get processed and ISE can still do the authorization phase.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-16-2019 05:34 AM
Are you asking when to use RADIUS proxy vs. RADIUS token server setup? Or just why would you send request to another RADIUS server?
If you are asking the first one basically it boils down to being able to pass back all the attributes from the external RADIUS server. When you use a RADIUS proxy setup all AV pairs handed back from the RADIUS server are sent back to the client. If you use a RADIUS token server setup you can select on attribute to receive back from the external RADIUS server. I prefer the RADIUS token server setup as it looks like any other identity source. In most cases I don't need any attributes coming back from the external RADIUS server.
As to why you would use an external RADIUS server the most common use case is MFA/2FA. You are passing the authentication over to an external MFA/2FA RADIUS server to get processed and ISE can still do the authorization phase.
