Trying to load Balance several Cisco ISE servers. For persistence, Cisco recommends using Calling-Station-ID and Framed-IP-address...Session-ID is recommended if load balancer is capable of it. I have documentation for the Cisco ACE, but using F5 LTM's. Assuming this has to be done with an I-Rule as none of these are available as a default. Not sue where to begin. I tried attaching the Cisco PDF, but not able for whatever reason. If anyone has any examples of knowledge of how to do this, would be appreciated. I can send the Cisco document via e-mail if that helps. I just am not able to attach it to this forum???

Hey Richard. The Session-ID of what? A RADIUS 'request'?

Yes, I believe it would be Radius Request. If fyou can provide me with an e-mail, I can send you the ACE configuration document, but reading thru that, I believe it would be a Radius Request.

Assuming this has to be done with an I-Rule as none of these are available as a default. Not sue where to begin. have you tried "Persist Attribute" setting in radius profile?

Hi Use source persistence the problem is with the Natting in theory you should create a pass though to the backend but i'm not sure how to do that on F5. if you bypass the F5 does it work or not?

Load Balance Cisco ISE servers

57 Replies

nitass

Employee

Jun 18, 2013

e.g.

[root@ve10:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.19.252:1812
   ip protocol 17
   rules myrule
   profiles udp_gtm_dns {}
}
[root@ve10:Active] config  b pool foo list
pool foo {
   members 200.200.200.101:1812 {}
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when CLIENT_ACCEPTED {
  log local0. "\[RADIUS::avp CALLING-STATION-ID\] [RADIUS::avp CALLING-STATION-ID]"
  log local0. "\[RADIUS::avp FRAMED-IP-ADDRESS\] [RADIUS::avp FRAMED-IP-ADDRESS]"
  persist uie "[RADIUS::avp CALLING-STATION-ID]:[RADIUS::avp FRAMED-IP-ADDRESS]"
}
}

[root@ve10:Active] config  tail -f /var/log/ltm
Jun 18 18:57:44 local/tmm info tmm[4950]: Rule myrule : [RADIUS::avp CALLING-STATION-ID] 123456
Jun 18 18:57:44 local/tmm info tmm[4950]: Rule myrule : [RADIUS::avp FRAMED-IP-ADDRESS] 1.1.1.1

[root@ve10:Active] config  b persist show all
PERSISTENT CONNECTIONS
|     Mode universal   Value 123456:1.1.1.1
|        virtual 172.28.19.252:1812   node 200.200.200.101:1812   age 14sec

Nick_Ehlers_132
Nimbostratus
Dec 09, 2013
Working iRule: when CLIENT_ACCEPTED { set framed_ip [RADIUS::avp 8 ip4] set calling_station_id [RADIUS::avp 31 "string"] log local0. "request from $calling_station_id:$framed_ip" persist uie "$calling_station_id:$framed_ip" }
rangara10_75278
Nimbostratus
Apr 09, 2015
Hi - what version of LTM was this irule working? Will this work on 11.2.1?

Will_131036
Nimbostratus
Aug 04, 2013
Did you get this working? I need the same persistence.
vaneet_133274
Nimbostratus
Sep 09, 2013
How to avoid SNAT as well on top of it?
nitass
Employee
Sep 09, 2013
How to avoid SNAT as well on top of it?

if return packet passes through bigip (e.g. server's default gateway is bigip), you do not need to configure snat automap under virtual server configuration.

is this what you are asking?
Amartya_Ghosh_1
Nimbostratus
Nov 06, 2013
I have tried this script and it worked as per our expectation. Thanks for sharing the script.
- Prakash_73226
  Nimbostratus
  Jan 26, 2015
  Hello Amarya - What script you are referring here ? CAn you please share as I am configuring ISE with LB in our company.
Amartya_Ghosh_1
Nimbostratus
Nov 08, 2013
Any Idea how we can change the persistence timeout in this case.
What_Lies_Bene1
Cirrostratus
Nov 08, 2013
You should be able to just change the timeout wherever you've used the 'persist uie' command in your rule. See here for more information: https://devcentral.f5.com/wiki/iRules.persist.ashx
SL
Cirrus
Nov 19, 2013
Hi All

can anyone shared how they have configured there VIPs to load balance the CISCO ISE servers.
Amartya_Ghosh_1
Nimbostratus
Nov 19, 2013
You can refer below config:

Virtual-Server:
ltm virtual vs_CISCO_ISE_xxxx { destination X.X.X.X:radius ip-protocol udp mask 255.255.255.255 pool Pool_CISCO_ISE_xxxx profiles { CISCO_ISE_UDP { } radiusLB { } } rules { ISE_Rule } }============

Profiles:
ltm profile udp CISCO_ISE_UDP { datagram-load-balancing enabled defaults-from udp }

ltm profile radius radiusLB { clients none persist-avp none }
- Nick_Ehlers_132
  Nimbostratus
  Dec 04, 2013
  Amartya, Can you give me the syntax of the iRule used for this? I can't seem to get it working.
Nick_Ehlers_132
Nimbostratus
Nov 20, 2013
Amartya Ghosh, can you go more into what you used for the iRule as part of your solution?