Cisco ISE Load Balancing
Hi , I am trying to load balance Auth and Accounting traffic from Cisco ISE. But I have my f5 implemented as f5 VE with a single interface dedicated for traffic and another for Mgmt. The issue is that my f5 Management IP lies in the same segment of Cisco ISE, even if I have declared the cisco ISE as the pool member I am not able to get the return traffic back from ISE , I can see the traffic is leaving f5 on interface 1.1 but I never see a reply from Cisco ISE. To resolve this issue , I tried a 443 vip for the same ISE nodes I was able to see the vip working for https traffic once I added a SNAT. But after reading so many documents and recommendations I used SNAT for the same radius vip too. Even then also I am awaiting a reply packet from Cisco ISE. Any help to complete this installation. Mgmt IP of Box : 10.1.1.100 nd 10.1.1.101 Cisco ISE Nodes : 10.1.1.50 and 10.1.1.51 --. they are using the same vlan Also the client cisco swithc is lying too in the same vlan of Mgmt. The mgmt ip of BigIP is 10.1.1.100 and Cisco ISE is 10.1.1.50 and 10.1.1.51 and both are lying in the same segment which has bene tagged to my BigIP VE. I am using a separate segment for VIP which is 192.168.36.0/24 which is routed on a separate vlan and tagged to the same pair of VE. Now I tested this deployment where everything is reachable via ICMP still I am not getting a reply packet from ISE Servers; Case 1 : when snat is enabled --> HTTPS traffic works but radius doesn't Case2 : When SNAT is disabled none of the traffic is even leaving the box. I have added the Self IP and floating as well as the Mgmt IP as allow device for Cisco ISE to allow the monitoring. So I am good with radius monitors for the same pair. Its the Client traffic which is entering the LB is not getting a reply.
SNAT 1:1 - Map client public IP to nat pool IP
I have a situation were we have a BIG IP F5 load balancer in front of a MS RRAS server acting as a VPN concentrator. When a user connects to the VPN the radius auth is proxied through a Cisco ISE instance to tie the user to an IP address, this allows us to create identity based firewall rules. The problem is at the moment RRAS is seeing all clients coming from the load balancer because we have SNAT enabled. In Cisco ISE you can only have one active session per endpoint ID and all users are comming through as the same endpoint ID (the load F5's internal SNAT address). So my question, it is possible to setup SNAT in a way that each client will come from a unique SNAT address from a SNAT pool?
Did you know that F5 BIG-IP can help smartly scale BYOD policy services ?
Does your corporate IT like to smartly address secure device identity management for BYOD endpoints ? Does your enterprise like to deploy device policy management solutions that are highly scalable ? Then you are sure to benefit from what we have to offer. It is a no brainer that the trends of Mobility and workload migrations to Cloud are an added impetus for increased profiling, monitoring and administrative traffic pertaining to devices connecting to the Network. This applies not just at a corporate headquarters site but also at geographically distributed sites, large Branches and Provider-hosted facilities, which get the services delivered out of the provider data center housing identity management solutions. F5 LTM can now be deployed with Cisco Identity Service Engine (ISE), which is a market leading Network access security policy management platform, to load balance identity services traffic What scenarios need load balancing of Cisco ISE traffic ? As we look at ways to provision thousands of BYOD endpoints, ISE devices need to be clustered so the policy service nodes (which offer run time network device services such as posturing, profiling, guest web services, AAA) can effectively address up to about 250,000 endpoints. Identity management is much more than basic RADIUS authentication and includes device profiling, endpoint posturing, administrative activities, monitoring, troubleshooting and data logging. Once basic authentication is complete, these devices - which could be static such as in the case of a video IP surveillance camera or mobile such as in the case of an employee owned smart tablet – need to be continuously postured, policy administered and monitored. The policy service node in the ISE persona handles run time traffic, which increases as the number of endpoints handled increases. How does F5 LTM specifically help ? As you cluster the ISE devices, traffic needs to be load-balanced and in cases such as device profiling, flow persistence with the same policy service node needs to be ensured. The F5 BIG-IP LTM enables load-balancing for the ISE policy node clusters and helps with health monitoring of the same ISE servers. Most importantly, customizable F5 iRules can be created to handle ‘persistence traffic’ differently and ‘Persistence profiles’ can be applied across Virtual servers. What benefits can this Solution provide ? Customers deploying the F5 LTM and Cisco ISE solution can • Significantly improve performance, scalability and availability for secure corporate LAN access traffic (ISE RADIUS, Profiling, and Web Service) • Optimize corporate LAN authentication, profiling, and database replication traffic by ensuring stickiness with same node in the ISE cluster that services requests • Enable Health monitoring and High availability of ISE servers using F5 load balancer probes • Simplify configuration for network devices and facilitate addition, changes and removals of the same for centralized servers Solution demo at Cisco Live Milan Stopby the F5 Networks booth (stand P2) at Cisco Live Milan 2015 to chat with technical experts and see a demonstration of the solution and its benefits. To Learn Further Please visit www.cisco.com/go/ise for more on Cisco ISE and https://f5.com/products/modules/local-traffic-manager for F5 BIG-IP LTM.
Problem with SNAT configuration
I´m trying to configure a SNAT for Cisco ISE Change Of Authorization (COA) . The goal is to have the virtual address from the load balance appearing as the source of all COA connections. This way I don´t need to add each policy server address to the NADs. I´m using LTM 11.0.0. I configured the SNAT as shown below: ltm snatpool /Sisop-Linux/radius_coa_snat { members { /Sisop-Linux/172.10.10.10 /*address used as origin } } ltm virtual /Sisop-Linux/vs-isepsn-coa { destination /Common/0.0.0.0:1700 ip-protocol udp mask any profiles { /Common/udp { } } snatpool /Sisop-Linux/radius_coa_snat translate-address disabled translate-port disabled vlans { /Common/v811-pool-net-services /*vlan where the police servers are located } vlans-enabled } The COA traffic never reaches the destination. A tcpdump on the balance shows that traffic is entering the "v811-pool-net-services" vlan but it doesn´t exit. Can anyone help me?
