Use NAS-IP Address to look up network device in ISE instead of source address

[rmueller@cisco.com]

Hi all,

to my knowledge, currently ISE uses per default the source ip address of the RADIUS-request to look up the network device. This can cause issues if there are NAT-devices between the network access device and the ISE.

Is there a known way to use the NAS-IP address within the RADIUS-packet to look up the network device instead?

Roland

[Francesco Molino]

Hi

I believe you're talking about wired devices.
What devices' models are you using?

Here a link that might help:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_radatt/configuration/xe-16/sec-usr-radatt-xe-16-book/sec-rad-nas-ip-cfg.html

[Arne Bier · Accepted solution]

Hi rmueller@cisco.com 

Nope - the NAS-IP-Address is not used in ISE's inbound RADIUS packet processing.  It's one of the reason's why Source NAT (SNAT) NAD breaks CoA, because ISE will never be able to perform the CoA to a device whose IP address has been source NAT'd.  ISE can send the CoA out, but the NAD's reply will be a SNAT'd UDP packet ... ISE will think the ACK never arrived. 

Craig Hyps famously had a phrase "SNAT for NAD is bad - SNAT for CoA is OK" - but you have to understand the IP packet flow to know what that means.