cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
188
Views
0
Helpful
4
Replies

ASA 5516-X does not connect to ISE via VTI

axiceleet
Level 1
Level 1

I have an ASA 5516-X witch firmware version 9.16(4)
I'm trying to configure aaa-server on the ASA

Spoiler
aaa-server ISE protocol radius
interim-accounting-update
aaa-server ISE (mgmt) host 172.16.1.100
key *****
authentification-port 1812
accounting-port 1813

This ASA has a site-to-site VPN connection to another ASA, behind which is an ISE server with IP address 172.16.1.100
When I perform a test authentication of aaa-server, the message "ERROR: Authentication Server does not answer: No active server found" appears
Command packet-traceroute from mgmt interace to ISE IP shows a drop in phase 2
There is IP communication between ASA and ISE. I can ping from ASA to ISE.
ASA settings:

Spoiler
interface Port-channel2.930
vlan 930
nameif mgmt
security level 100
ip address 10.10.200.1 255.255.255.0 backup 10.10.200.2
!
interface Port-channel1.2111
vlan 2111
nameif outside1
security level 0
ip address X.X.X.X Y.Y.Y.Y
!
interface Tunnel5
description to_ISE
nameif VTI
ip address 10.250.251.5 255.255.255.252
tunnel source interface outside1
tunnel destination A.A.A.A
tunnel mode ipsec ipv4
tunnel protection profile ipsec VTI_prof
!
access-list ISE extended permit udp host 10.10.200.1 host 172.16.1.100 eq 1812 log
access-list ISE extended permit udp host 10.10.200.1 host 172.16.1.100 eq 1813 log
!
access-group ISE in interface mgmt
!
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

What can block radius request packets from ASA to ISE?

4 Replies 4

Use VTI nameif as interface to connect to ISE 

Mgmt interface I think can not use here.

MHM

ASA can't use VTI name to configure aaa-server.
I have tried to use nameif outside1 as interface to connect to ISE. Also I have changed nameif magmt to inside1.
The resule is the same.

You use inside' that good 

The only two steps need more

1- sure you have route to ISE via vti

2- config inside with management-access 

I send you PM

MHM

axiceleet
Level 1
Level 1

I configured the inside interface instead of the mgmt interface. The result is the same. The inside interfaces have the management-access command. There is a route to ISE via vti. I can ping from a host on the 10.10.200.0 network to ISE But packet-trace icmp from the ASA interface to ISE shows Phase2 drops. Packet-trace udp is also dropped. It seems that packets from the ASA's own IP interface to ISE are dropped by the ASA. I have other network devices on the 10.10.200.0 network. All devices connect to the ASA via the vti interfcae without problems.