Integration of ISE with Cisco ACS

[ipagliani]

Ciao,

In a scenario with 802.1x and MAB implemented with ACS, is it possible integrate ISE via RADIUS proxy only for guest author purpose?

Iarno

[Anas Naqvi]

Hello Iarno,

The  Cisco ISE can function both as a RADIUS server and as a RADIUS proxy  server. When it acts as a proxy server, the Cisco ISE receives  authentication and accounting requests from the network access server  (NAS) and forwards them to the external RADIUS server. The Cisco ISE  accepts the results of the requests and returns them to the NAS. You  must configure the external RADIUS servers in the Cisco ISE to enable it  to forward requests to the external RADIUS servers. You can define the  timeout period and the number of connection attempts.

The  Cisco ISE can simultaneously act as a proxy server to multiple external  RADIUS servers. You can use the external RADIUS servers that you  configure here in RADIUS server sequences. This External RADIUS Server  page lists all the external RADIUS servers that you have defined in  Cisco ISE. You can use the filter option to search for specific RADIUS  servers based on the name or description or both.

You can further use the below link,

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_auth_pol.html#wp1127216

All the best.

[Ravi Singh]

You can also see the following post

https://supportforums.cisco.com/thread/2219588

https://supportforums.cisco.com/thread/2210095

[aqjaved]

Proxy  Service :Cisco ISE acts as a RADIUS  proxy server by proxying the requests from a network access device  (NAD) to a RADIUS server. The RADIUS server processes the request and  returns the result to Cisco ISE. Cisco ISE then sends the response to  the NAD. In both simple and rule-based authentication policies, you can  use the RADIUS server sequences to proxy the requests to a RADIUS  server.

For  Complete Radius Configuration, please watch the below video

http://www.youtube.com/watch?v=0fc0hi1M1lY

[Venkatesh Attuluri]

Current version of ISE 1.2 does not support TACACS + .

ISE Release 1.2 does not interoperate with Cisco Secure ACS deployments

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/qa_c67-658591.html

[ipagliani]

Hello,

thank for responses.

In my scenario I can't put ISE in front of switches but I need to configure ACS as proxy Radius and ISE as Radius client. In that case I'm not sure I able to configure ISE as guest access authenticator (On switches the only Radius server configured are ACSs).

For istance: when a guest is connecting on the switch, the ACS send URL redirect  ( 802.1x and MAB timeout) to redirect to ISE i address..... is session id maintained ? What about radius accouning sent to ACS and not to ISE ?

These are my concerns

[blenka]

Your ISE device can also act as radius proxy.

For the configuration please go through the link.

http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_ug.pdf 

Cisco ISE Acting as a RADIUS Proxy Server

Cisco ISE can simultaneously act as a proxy server to multiple external RADIUS servers. You can use the external RADIUS servers that you configure here in RADIUS server sequences. The External RADIUS Server page lists all the external RADIUS servers that you have defined in Cisco ISE. You can use the filter option to search for specific RADIUS servers based on the name or description, or both. In both simple and rule-based authentication policies, you can use the RADIUS server sequences to proxy the requests to a RADIUS server. Cisco ISE can function both as a RADIUS server and as a RADIUS proxy server. When it acts as a proxy server, Cisco ISE receives authentication and accounting requests from the network access server (NAS) and forwards them to the external RADIUS server. Cisco ISE accepts the results of the requests and returns them to the NAS.

The RADIUS server sequence strips the domain name from the RADIUS-Username attribute for RADIUS authentications. This domain stripping is not applicable for EAP authentications, which use the EAP-Identity attribute. The RADIUS proxy server obtains the username from the RADIUS-Username attribute and strips it from the character that you specify when you configure the RADIUS server sequence. For EAP authentications, the RADIUS proxy server obtains the username from the EAP-Identity attribute. EAP authentications that use the RADIUS server sequence will succeed only if the EAP-Identity and RADIUS-Username values are the same.

[Muhammad Munir]

Hi

Cisco ISE device can act also as a RADIUS Proxy. Every Cisco ISE administrator account is assigned one or more administrative roles. To perform the operations described below, you must have one of the following roles assigned:

Super Admin or Network Device Admin.

Network access authentication supports UTF-8 username and password credentials. This includes RADIUS, EAP, RADIUS proxy, RADIUS token, web authentication from the Guest and Administrative portal login authentications. This provides end users network access with a UTF-8 user name and password, as well as administrators with UTF-8 credentials. UTF-8 support for user name and password applies to authentication against the local identity store as well as external identity stores. UTF-8 authentication depends on the client supplicant that is used for network login. Some Windows native supplicants do not support UTF-8 credentials.

[kaaftab]

Yes ISE is a combination of ACS and NAC and can act as radius proxy as wel