ISE Deployment - Limit on Radius Sources?

Greetings,
I am planning a change to our ISE deployment, and I am curious if there is a limitation to the number of Radius sources that can be added to the running config on the switches and APs.
The majority of the switches are 2960 series and the APs are 2602 models.
Currently, we have two Radius Sources configured as follows:
aaa group server radius rad_eap
server X.X.X.X auth-port 1645 acct-port 1646
server X.X.X.X auth-port 1645 acct-port 1646
I need to know if I am able to add a third entry to that list, or if there is a hard limitation I am unaware of.
Thank You.

ISE questions will probably get more traction in the Security forum.
That said, the answer is "it depends". It all depends on your design. Is your third server a Policy Services Node or an Inline Posture Node (IPEP)? Either way, one of those would generally be positioned so as to provide profiling, posture and enforcement services working in conjunction with the Admin server(s). If a server is not part of the overall architecture, it will not.
All new ISE designs should be based on the Cisco-approved High Level Design (HLD) template. If you follow that and develop your Low Level design based on it, many of the typical questions should be answered.
Hope this helps.

Similar Messages

ISE 1.2.1 - RADIUS service down after Promoting Secondary PAN

Hi Experts,
I have currently a ISE deployment where I run a Dual Node construct (both 3495)
ISE-1: PAN (Primary), MNT (Secondary), PSN
ISE-2: PAN (Secondary), MNT (Primary), PSN
When ISE-1 fails and ISE-2 is promoted to Primary PAN then the services are restarted. This causes also the radius service to go down which causes a full RADIUS outage. Also if ISE-1 is online again and is re-promoted, also both ISE instances restart simultanious the services which includes the RADIUS service. Again full RADIUS outage.
A ISE service restart takes about 10-15 minutes.
Is this "workes as designed" or a bug? I think this behavior was different in ACS 5.X
Best Regards Michael

List of working (Y) and Non Working (N) if Primary PAP is down
Existing internal user radius auth : Y
Existing/New AD user radius auth : Y
Existing endpoint with no profile change : Y
Existing endpoint with profile change : Y
New endpoint learned via profiling : Y
Existing guest (LWA) : Y
Existing guest (CWA) : Y
Guest - Change Password : N (user must log in using old password)
Guest - AUP : Y (displayed for every login)
Guest - Max Failed Login Enforcement : N
New guest (Sponsored or Self-Registration) : N
Posture : Y
New Device Registration : N
Existing registered device : Y

ISE deployment in wireless infra without WLC (only Access Point 1240AG)

Hello All,
I am having access point 1240AG and planning to deploy ISE as a exteral radius server. I would like to know how deifferent authorization policy need to configure in AP/ISE. Whether I can use named ACL or VLANs (CoA) as a enforcement types without use of WLC. If yes then how?
Thanks in advance.

Hi,
You can perform COA on standalone APs you will need to have an inline posture node in order to reap the benefits of COA, you may have heard this from any vpn related deployments. If you are in the design phase of this project, you may want to purse controllers because the latest rumor is that the inline posture node may be dropped since Cisco is planning on supporting coa on all their devices once the 9.x code drops for the ASAs. However please contact your Cisco rep for an official response.
Here is the footnote in the following link: "Autonomous AP deployments (no WLC) also require deployment of an Inline Posture Node for posture support."
http://www.cisco.com/en/US/docs/security/ise/1.1/compatibility/ise_sdt.html#wp55038
Thanks,
Tarik admani

Cisco ISE Deployment suggestion required

Require Assistance on Cisco ISE Deployment for below scenario
-- We have Three Cisco ISE Appliances and Client has taken Advance Subscription License for 500 users
-- Client has DC & DR and needs to deploy the Cisco ISE in one Main Office which connects to DC & DR on MPLS Links
-- Client suggestion was to deploy one ISE node ( Admin + M&T + Policy Server ) in DC and its Standby Secondary in DR
     and only deploy Policy Server in Main Office.
     Idea behind the design is that ,
     1) If DC fails , Cisco ISE related logs will get generated on DR and any Cisco ISE related request will be taken care by Local Policy Server in Main Office .
      2) If Local Policy Server Fails , then ISE node in DC will act as Secondary backup and DR will act Teritary Backup
      below is view
                                     DC
                        Primary Node with Role
                   [Admin , M&T , Policy Server]
                                                                                                             Main Remote Offic
                                                                                                              Cisco ISE Node ( Only Policy Server) -----------> Network Devices
                               DR
                       Secondary   Node with Role
                   [Admin , M&T , Policy Server]
Please let me know is it possible

Yes, The scenario is quite achievable also please review the below link for assistance on deployment of ISE.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_50_ise_deployment_tg.pdf
http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.pdf

Bandwidth Limit based on Source IP?

Hi
I am trying to think of a way to apply a bandwidth limit based upon Source IP subnet.
I need to have the ability to limit both the outbound and inbound traffic.
So I created the following config:
policy-map bw-limit-inbound
class bw-limit-class
police 10000
class-map match-any bw-limit-class
match access-group 150
access-list 150 permit ip 172.16.99.0 0.0.0.255 any
If I apply the Service Policy inbound, it does police the upload to 100Kbps.
If I apply it outbound, it does nothing to the download.
Any reason for this?
I am applying this to an SVI
Thanks

Hi Guys
Just to update this thread, I figured out where I was going wrong!
As mentioned by Mikael, the ACL only shows traffic one way, hence why it was not applying the service policy to the download.
I have three subnets I want to Police both outbound and inbound so I started with Three ACLs:
access-list 197 permit ip 172.16.97.0 0.0.0.255 any
access-list 197 permit ip any 172.16.97.0 0.0.0.255
access-list 198 permit ip 172.16.98.0 0.0.0.255 any
access-list 198 permit ip any 172.16.98.0 0.0.0.255
access-list 199 permit ip 172.16.99.0 0.0.0.255 any
access-list 199 permit ip any 172.16.99.0 0.0.0.255
I then created the relevant class maps:
class-map match-all vlan998-download
match access-group 198
class-map match-all vlan999-download
match access-group 199
class-map match-all vlan997-download
match access-group 197
class-map match-all vlan998-upload
match access-group 198
class-map match-all vlan999-upload
match access-group 199
class-map match-all vlan997-upload
match access-group 197
Then the service policies:
policy-map download-limit
class vlan997-download
police 2000000
class vlan998-download
police 3000000
class vlan999-download
police 4000000
policy-map upload-limit
class vlan997-upload
police 200000
class vlan998-upload
police 300000
class vlan999-upload
police 400000
Then finally applied those to the relevant SVI:
interface Vlan102
ip vrf forwarding WAN2
ip address 10.20.2.2 255.255.255.0
ip nat inside
ip virtual-reassembly in
service-policy output download-limit
service-policy input upload-limit

Radius source-interface not working ?

I'm running IOS 150-2.SE2 on 3750-X switches.
In my config, I have the command:
ip radius source-interface Loopback1
but all radius requests still have the source IP address of the "nearest" interface, not the loopback interface.
Interface Loopback1 is up and is pingable from the radius server.
Any suggestions ?
Thanks,
GTG

The only command I can see for controlling radius source address/interface is that global ip radius source-interface command.
My full AAA configuration is:
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius if-authenticated
aaa authorization network default group radius
aaa accounting exec default start-stop group radius
aaa accounting system default start-stop group radius
ip radius source-interface Loopback1
radius server radius1
address ipv4 192.168.1.1 auth-port 1812 acct-port 1813
key 7
GTG

ISE 1.2 rejects RADIUS messages from vWLC

Hello,
I have an ISE appliance with the Wireless license. The Cisco vWLC is configured to send Radius traffic to the device, but is getting the error message:
11054 Request from a non-wireless device was dropped due to installed Wireless license
The vWLC is showing up under endpoints as a VMWARE workstation, and not a WLC, and so under the licensing requirements will not allow RADIUS to be received from anything other than a WLC. I tried hard-coding the policy to match a Cisco WLC with a condition of matching its MAC address, and even disabled the VMWARE profile policy, but the endpoint then only matches the "Unknown" policy. Any ideas?

Check the Cisco ISE dashboard (
Operations > Authentications
) for any indication
regarding the nature of RADIUS communication loss. (Look for instances of your
specified RADIUS usernames and scan the sy
stem messages that are associated with
any error message entries.)
Log into the Cisco ISE CLI
2
and enter the following command to produce RADIUS
attribute output that may aid in debugging connection issues:
test aaa group radius
new-code
If this test command is successful, you should see the following attributes:
Connect port
Connect NAD IP address
Connect Policy Service ISE node IP address
Correct server key
Recognized username or password
Connectivity between the NAD and Policy Service ISE node
You can also use this command to help narrow the focus of the potential problem
with RADIUS communication by deliberatel
y specifying incorrect parameter values
in the command line and then returning to the administrator dashboard (
Operations
> Authentications
) to view the type and frequency
of error message entries that
result from the incorrect command line. For example, to test whether or not user
credentials may be the source
of the problem, enter a username and or password that
you
know
is incorrect, and then go look for error message entries that are pertinent
to that username in the
Operations > Authentications
page to see what Cisco ISE
is reporting.)
Note
This command does not validate whether or not the NAD is configured to use
RADIUS, nor does it verify whether th
e NAD is configured to use the new
AAA model.

Using ISE guest store via RADIUS

I have a question concerning the guest store on the ISE.
I would like to establish a guest portal on a WLC (currently running version 7.0.220.0). The guest network shouldn’t have any connection to the company network. So I can’t redirect to the ISE guest portal and have to use the local portal on the WLC and pass the login data to the ISE via RADIUS. Nevertheless I want to use the guest store on the ISE.
On the ISE I can only select the internal user store as identity source. But this seems not to include the guest user store.
Has anyone already implemented a similar solution or any idea how to access the guest store?
Thanks
Thomas

I just created a simple setup and tested the login.
It doesn't work with a user created as a guest account.
If I create the user in the normal internal identity store I works fine.
Might there be a difference between ISE Versions?
We are currently using Version 1.1.0.665 on a VM for testing purpose.
This is what the details show:
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - tuser001
24206 User disabled
22057 The advanced option that is configured for a failed authentication request is used
22061 The 'Reject' advanced option is configured in case of a failed authentication request
11003 Returned RADIUS Access-Reject
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - tuser001
24212 Found User in Internal Users IDStore
22037 Authentication Passed
Evaluating Authorization Policy
15004 Matched rule
15016 Selected Authorization Profile - Guest
11022 Added the dACL specified in the Authorization Profile
11002 Returned RADIUS Access-Accept

ISE MAB to external Radius then MAB internal for Guest User auth

Hello guys,
we have the following requirements for our ISE Guest Access Deployment:
We want to provide guest access but only to non Company Laptops. To check if the Laptop is company or a non company Laptop we have have all MAC Addresses in our ACS server. So in my understanding we have to to the following.
Check the MAC Address against the External Radius Server (ACS)
If Access-Accept returns -> Deny Access
If Access-Deny returns -> Check MAC Address against Internal Endpoint Store
If User not found -> Guestflow
Right now i don´t no how i can sould design it but i need two Authentication Policys first for the redirect to the External Radius and then another one for check against internal Identity Endpoint Store. Am i right ? I don´t know if that is possible.
Really thanks for your help!!
Greetings
Philip

Let me ask you a quick question: Are all domain machines Windows and joined to AD?

ISE Deployment - Your Feedback

Hi,
I am currently evaluating two NAC systems: ISE and Bradford and I wanted to see if anyone has had the opportunity to see both systems. Although we are a Cisco shop, I am looking for simplicity due to staff shortage.
In the event I decide to go with ISE, I would like to hear your personal challenges with the product during the deployment phase and those little things I need to keep in mind to avoid future headaches.
Thanks in advance !

Hello,
I have one done (not finished) one deployment with 150 clients. And one guy I know is doing a very large scale deployment.
To me it's very interesting but very challenging. I really under estimated the time it would take. I did this project because my client wanted it. From a technical point of view it's very positive for me, from a financial point of view it's really bad as I've spent a lot of time.
The client is so far very happy although some implemented features are missing.
I would recommend to start with Wifi only and once you understand ISE and know how to troubleshoot make Wire to work. I have not tried remote access though.
Some hints:
- You're full Cisco or you have other vendors (I'm thinking about IP Phones but the question can also be asked for switches and wlc)
- You have a PKI or not.
- You have devices (endpoints) and they are not 802.1X capable. All of us have, but the important is to list them.
It's also difficult because it involves a lot of components and protocols:
- Components: The radius server (ISE), the NAS (Switch or WLC), the endpoints (PC, APs, printers), the host (in my case VMWare)
- Protocols: EAP protocols, Snmp/DHCP for profiling, Wifi etc.
So I wouldn't see a guy with a little experience in networking dealing with something like this. I was more than familiar with many of these things. And before ISE I also tried Freeradius and made is work with Wifi and Vlan assignement and a LDAP server.
If by chance I make the whole thing to work I need to give the skills to someone else to do a troubleshooting.
So this is my experience so far. Some other have much more experience of course.

ISE Sponsor Authentication via RADIUS

My client is requesting us to change the way the sponsor users are authenticated and authorized to access the ISE Sponsor Portal.
Their like to pass the ISE request to AD through a RADIUS server first. They said "to avoid sending AD credentials to ISE directly". Under this requirements,
My search and limited knowledge give me to assume I should define a Proxy RADIUS
I think I can Define an External RADIUS server, but I wonder if creating this, it would be available as an Identity Source for the "Sponsor Portal Sequence".
If not, how can I add this? After that, what conditions or attributes should I look for to use in the "Sponsor Group Policy" in order to filter username/password and allow access only to employees and deny access to anyone else?
I will appreciate any advice you can give me to offer the best recommendation to the customer.
Regards.
Daniel Escalante.

I think I understood the customer concern. This is quoted from Microsoft http://support.microsoft.com/kb/321051
"The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory. By default, LDAP traffic is transmitted unsecured. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology."
So the question now is how can we be sure the ISE communication is secure? ... I understand port 636 is used to transport LDAP-Secure ...
The ISE User Gude indicates that one of the ports required to be open in the case a firewall exists between ISE and ADE is 636 (LDAPS). -(ISE User Guide Page 5-6)
In my case there is no FW between ISE and AD, so where or how can I show the customer we are using LDAPS?
Regards.

SSRS CatalogItem method not working for deploying a shared data source

I have been working with the SSRS CreateCatalogItem method to deploy reports to a SSRS 2012 in SharePoint integrated mode with SharePoint Server Enterprise 2013. I am using Powershell. The CreateCatalogItem method works fine when I deploy RDL files,
but fails when I deploy an RDS. I get an rsInvalidXML1400 error, whatever that is. Here is a cut-down version of my code to establish the bare essentials:
    [String] $reportserver = "server20";
    [String] $url = "http://$($reportserver)/sites/AdventureWorks/_vti_bin/reportserver/reportservice2010.asmx?WSDL";
    [String] $SPFolderPath = "http://server20/sites/AdventureWorks/BICenter/Data%20Connections/";
    [String] $fileFolder = "C:\SiteBackups\BIReports\BIReports\";
    [String] $itemName = "AdventureWorksCube.rds";
    $ssrs = New-WebServiceProxy -uri $url -UseDefaultCredential;
    $warnings = $null;
    $itemPath= $($fileFolder + $itemName);
    $definition = get-content $itemPath -encoding byte;
    try
        $ssrs.CreateCatalogItem("DataSource", $itemName, $SPFolderPath,$False,$definition,$null, [ref] $warnings);
    catch [System.Web.Services.Protocols.SoapException]
        $msg = $_.Exception.Detail.InnerText;
        Write-Error $msg;
I have a workaround whereby I read the XML of the data source file directly and extract the ConnectString and Extension elements then use the text within them to create the data source using the DataSourceDefinition class. My point is not to get a workaround.
I want to establish that the CreateCatalogItem method indeed does not work when used with the ItemType "DataSource". In the code above, if I change the itemType i.e. first parameter of CreateCatalogItem to "Report" and change the $itemName
to the name of an RDL file, it deploys correctly. Has anyone else encountered this behavior or am I doing something wrong here?
Charles Kangai, MCT
author of the following Microsoft Business Intelligence courses:
http://www.learningtree.co.uk/courses/139/sql-server-analysis-services-for-business-intelligence/
http://www.learningtree.co.uk/courses/134/sql-server-integration-services-for-business-intelligence/
http://www.learningtree.co.uk/courses/140/sql-server-reporting-services/
http://www.learningtree.co.uk/courses/146/sharepoint-business-intelligence/
Charles Kangai, MCT

Hello,
We can invoke the SSRS proxy endpoint (ReportService2006.asmx)from PowerShell to publish report definitions (.rdl) and report models (.smdl) to a SharePoint library, but this does not apply to data source (.rds) files.
In order to deploy .rds to SharePoint library without using SSDT, you should convert the .rds file to its .rsds counterpart which is pretty contains same content but in different schema.
If you want to fully automate your deployment, you should write your own converter and perform the deployment by utilizing SharePoint feature framework and SSRS proxy endpoint (ReportService2006.asmx).
Please refer to the following blog about this issue:
PowerShell:Deploying SSRS Reports in Integrated Mode
Deploying Reports in Integrated Mode
Regards,
Fanny Liu
If you have any feedback on our support, please click
here.
Fanny Liu
TechNet Community Support

Is There A Character Limit to Region Source?

I created a PL/SQL Dynamic Content region. I was in the process of adding PL/SQL code to region source and every thing was working fine when I started getting the following error when ever I press the Apply Changes button:
1 error has occurred
ORA-06550: line 609, column 1: PLS-00103: Encountered the symbol "END" when expecting one of the following: * & = - + ; < / > at in is mod remainder not rem <> or != or ~= >= <= <> and or like LIKE2_ LIKE4_ LIKEC_ between || member SUBMULTISET_ The symbol ";" was substituted for "END" to continue.
I cannot find anything wrong with the PL/SQL code. I did notice however, that if I remove enough lines of code the error message goes away. Is there some limit to the number of lines or number of characters the region source can hold?? If so is there some way to increase this limit? Thanks for the help.

I understand what you are saying. I looked up mod_plsql and understand this is a limitation of the Oracle HTTP web server. But is there a way to configure the web server so it can handle more data? I find it hard to belive that people are not writting a lot longer PL/SQL code than I am.

ISE 1.2 rejects RADIUS messages from 5508 WLC

The setup in ref is:
WLC 5508 HA pair running 7.6 talking to ISE 1.2 patch 7 (was 6).
Wireless users are authenticated fine, so the 5508 is a valid NAD in ISE, but...
When I setup active RADIUS fallback, so that the WLC can poll the ISE servers I get the message:
"The RADIUS request from a non-wireless device was dropped because the installed license is for wireless devices only"
Why would ISE drop a RADIUS message from a WLC which is a wireless device? Surely this is a mistake?

Hi Nicholas,
This is a known defect.
CSCug34679 ISE drop keep alive coming from WLC.
Symptom:
ISE drops keep alive authentications coming from the WLC, with message 11054 Request from a non-wireless device due to installed wireless license.
Conditions:
When only a wireless license is install on the ISE and using active keep alive on the WLC.
Workaround:
Use passive keep alive on the WLC and not active.
Regards,
Jatin Katyal
*Do rate helpful posts*

Cisco ISE Deployment

Dears,
We have 2 ISE server. I configured wired, wireless,vpn, guest user authentication from ISE server. All of them are normal working. Both of ISE server have same Image.(ver 1.2) I deployed ISE servers as HA. I register second ISE server at primary ISE server. I attached the configuration files.
I want one ISE device is primary( Administration, Monitoring and Policy are active in primary ISE) and the other ISE server is backup or standby. (Administration, Monitoring and Policy are standby). When the Primary ISE server is going to down then all AAA process is going through the secondary ISE server( it is like redundancy on ASA)
Is it possible to configure? If yes how I do this configuration?
Thank for your helping.

ISE 1.2 does not have an Automatic Failover for the Admin Nodes. If the primary node goes down, you have to manually promote the secondary node.
Until you promote the secondary, the deployment has very serious limitations:
So, you see, there is no true HA with Automatic Failover for ISE 1.2.You have to have both ISE servers on anyway and the Monitoring Persona is the only one that does support Automatic Failover, so it really does make sense to deploy your nodes as noted here:
Node1: Admin (Primary), Monitoring (Secondary), Policy Service
Node2: Admin (Secondary), Monitoring (Primary), Policy Service
The notes I referenced can be found in the ISE 1.2 User Guide.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE Deployment - Limit on Radius Sources?

Similar Messages

Maybe you are looking for