Load Balance Cisco ISE servers

Did you get this working? I need the same persistence.

How to avoid SNAT as well on top of it?

How to avoid SNAT as well on top of it?

if return packet passes through bigip (e.g. server's default gateway is bigip), you do not need to configure snat automap under virtual server configuration.

is this what you are asking?

I have tried this script and it worked as per our expectation. Thanks for sharing the script.

Any Idea how we can change the persistence timeout in this case.

You should be able to just change the timeout wherever you've used the 'persist uie' command in your rule. See here for more information: https://devcentral.f5.com/wiki/iRules.persist.ashx

Hi All

can anyone shared how they have configured there VIPs to load balance the CISCO ISE servers.

You can refer below config:

ltm virtual vs_CISCO_ISE_xxxx { destination X.X.X.X:radius ip-protocol udp mask 255.255.255.255 pool Pool_CISCO_ISE_xxxx profiles { CISCO_ISE_UDP { } radiusLB { } } rules { ISE_Rule } }============

ltm profile udp CISCO_ISE_UDP { datagram-load-balancing enabled defaults-from udp }

ltm profile radius radiusLB { clients none persist-avp none }

Amartya Ghosh, can you go more into what you used for the iRule as part of your solution?

You'll want to ensure you load balance both your accounting and authentication packets to the same node. I did this with two VIPs, and used Match Across Services in a universal persistence profile and calling station ID in the iRule.