Load Balance Cisco ISE servers

THis is a new trun-up. Testing this week and next.

 

 

Couple of bullet points that are taken from the Cisco ACE configuration PDF....

 

 

• Load Balancers get listed as NADs in ISE so their test authentications may be answered.

 

 

• ISE uses the Layer 3 address to identify the NAD, not the NAS-IP-Address in the

 

RADIUS packet. This is a primary reason to avoid Source NAT (SNAT) for traffic sent to

 

VIP.

 

 

So the way I'm understanding it is that NADs or network access devices which are the end station send the request to the LTM’s. Once the packet hits the LTM, then the LTM becomes the NAD from the perspective of the ISE servers.

 

I don' think source persistence works because on the initial request the end device still doesn't have an IP address. The ISE servers determine who and what the client is, and then based on that assign the vlan and IP space etc.

 

 

I had never used the "Persist Attribute" setting in radius profile before. I see where that setting is, but where do you apply it once you create it?

I believe a RADIUS profile is assigned to a Virtual Server.

 

 

Based on your notes about the initial L3 address (it must have one) changing, is the persistence required initially? I assume the VLAN and address assignment is all done over a single connection. After that, what comes next, does it have to go to the same server? It'll be a new connection for sure as the source IP would have changed I assume. Don't the ISE servers share state in some way? It seems poor that they don't.

 

 

The operation doesn't exclude the use of SNAT btw, but to use it you'd have to use static translations (not automap etc.)

 

@Richard, have you managed to get this working?

 

 

Unfortunately, I got pulled into some other stuff and this got passed onto another engineer. I'm trying to find out if he got it resolved. If so, I will post the answer.

 

Thanks, Rich

I'm also in the same boat.. Persist attribute in the Radius profile only seems to take one value, which i'm currently using Calling-Station-ID and i'm getting suboptimal results. Anyone made any headway on this?

Good afternoon. New F5 user here - but I also need to use F5's to load balance my Cisco ISE servers.

Persist attribute in the Radius profile only seems to take one value, which i'm currently using Calling-Station-ID and i'm getting suboptimal results.you do not have to use persist attribute in radius profile. you are able to use persist irule command to persist whatever avp data or any combination you want.

I'll probably have to dig around for an example on how to do this, then. The radius load balancing irule examples I've seen seemed a little complicated and perhaps more involved than I was expecting to get. Cisco provides plenty of examples on how to do this but it's limited to ACE load balancers.

i do not think it is going to be too complicated. i understand you just retrieve avp you want to persist on using RADIUS::avp and use it in persist uie command.

 

RADIUS::avp wiki https://devcentral.f5.com/wiki/irules.RADIUS__avp.ashx

 

sol7392: Overview of universal persistence http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7392.html