Use 2 interfaces on ISE appliance for Radius redundancy?

[Leroy Plock]

Hey.

We normally provide network redundancy for critical devices by patching 2 of the device's interfaces to either side of a VSS pair (or 7K pair) and forming an etherchannel of the 2 links.

Since our ISE SNS-3415 appliances don't support etherchannel, I wondered if I could do this:

Patch 2 interfaces from the appliance, one to each side of the VSS.
Assign separate IP addresses to the interfaces. Preferably both IPs would be in the same subnet.
Configure NADs with the 2 IPs, as though it was 2 separate ISE nodes.

If one link went down, the other link would still be up and respond on the other IP. The NAD would declare the primary IP dead and start sending Radius requests on the second IP.

Can this be done?

Thanks.

[jj27]

I believe only gig0 on the appliance can be used for system RADIUS access.  The other NICS can be used for Profiling such as DHCP, NetFlow, etc.

Typically you would have redundant PSNs so that if one goes offline the other will take over authentication/authorization requests. You would point your NADs to the PSNs.

[Leroy Plock]

Yep, we have multiple PSNs in different locations. Just always looking for more redundancy.

I wasn't able to verify your answer, but you're probably right. I did read in the manual that each interface must be configured on a separate subnet.

[ajc]

Following this post. I am planning to do the same thing on our 3395 and 3945 ISE's. I have not checked again the documentation but looks like this is not feasible since port-channel is not supported.

[Venkatesh Attuluri]

Cisco ISE management is restricted to Gigabit Ethernet 0. And all ports can be used for radius.If its distributed deployment then you can have PSN node groups or have all PSN listed as radius server on NAD

[Leroy Plock]

Thanks, good to hear an authoritative answer from Cisco. The separate subnet for each interface limitation would make this a little more difficult to implement, but not so bad.

My understanding that is that even if the PSNs are in a node group, they must be listed individually on the NAD. If you want to reference them by a single IP you would have to use a load balancer. Did I get this wrong?

[jason chu]

Hi Leroy Plock,

Can you configure two IPs on a SNS3415? if yes, can NAD take request to the both IPs?