Support for 3rd party VPN concentrator with ISE 2.2

[Jimi]

Hi All,

May I confirm that currently the supported use-case for 3rd party VPN concentrator are only for AAA services if they are able to support these radius attributes:

AAA Attributes for Third-Party VPN Concentrators

For VPN concentrators to integrate with Cisco ISE, the following authentication, authorization, and accounting (AAA) attributes should be included in the RADIUS communication:

• Calling-Station-ID (tracks individual client by MAC or IP address)
• User-Name (tracks remote client by login name)
• NAS-Port-Type (helps to determine connection type as VPN)
• RADIUS Accounting Start (triggers official start of session)
• RADIUS Accounting Stop (triggers official end of session and releases ISE license)
• RADIUS Accounting Interim Update on IP address change (for example, SSL VPN connection transitions from Web-based to a full-tunnel client)

---

Note For VPN devices, the RADIUS Accounting messages must have the Framed-IP-Address attribute set to the client’s VPN-assigned IP address to track the endpoint while on a trusted network.

Profiling and Posture on 3rd party VPN concentrator (e.g. checkpoint or juniper) are not available with ISE 2.2 currently?

Best Regards,

Jimmy

[hslai · Accepted solution]

You are correct.

Craig said,

We can integrate as a standard AAA server for RADIUS services, but comprehensive support for services like Posture/MDM are currently limited due to lack of CoA support on the 3^rd-party VPN gateway.

... Make sure NAD Profile has Juniper dictionary loaded if not using default Juniper NAD profile.

[dngore]

Hi,

Is it same status for third party VPN concentrator? We are doing PoC for bank customer. They have Juniper firewall where VPN clients terminate. Customer wants to have authentication and posture verification for VPN clients.

Is it possible with ISE 2.4 and Juniper firewall?

Can't we use inline PSN solution that we used for Cisco ASA previously?

Regards,

D.M.Gore

[Jason Kunst]

Please see the answer it mentions juniper firewall, not sure of your question seems like already answered?

[dngore]

Yes, I do understand third party devices do not support CoA, hence can't have posture support. But can't we use inline ISE PSN node to support device with CoA support?

[hslai]

The last ISE release supporting an inline posture node is of ISE 1.4.

Features Not Supported in Cisco ISE, Release 2.0

Inline Posture Node (IPN / iPEP)

[Jimi]

Understood. Thank you