ISE Sponsor Authentication via RADIUS

Question

My client is requesting us to change the way the sponsor users are authenticated and authorized to access the ISE Sponsor Portal.
Their like to pass the ISE request to AD through a RADIUS server first. They said "to avoid sending AD credentials to ISE directly". Under this requirements,
My search and limited knowledge give me to assume I should define a Proxy RADIUS
I think I can Define an External RADIUS server, but I wonder if creating this, it would be available as an Identity Source for the "Sponsor Portal Sequence".
If not, how can I add this? After that, what conditions or attributes should I look for to use in the "Sponsor Group Policy" in order to filter username/password and allow access only to employees and deny access to anyone else?
I will appreciate any advice you can give me to offer the best recommendation to the customer.
Regards.
Daniel Escalante.       

Answer 1

I think I understood the customer concern. This is quoted from Microsoft http://support.microsoft.com/kb/321051
"The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory. By default, LDAP traffic is transmitted unsecured. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology."
So the question now is how can we be sure the ISE communication is secure? ... I understand port 636 is used to transport LDAP-Secure ...
The ISE User Gude indicates that one of the ports required to be open in the case a firewall exists between ISE and ADE is 636 (LDAPS). -(ISE User Guide Page 5-6)
In my case there is no FW between ISE and AD, so where or how can I show the customer we are using LDAPS?
Regards.