topic Re: Palo Alto and Cisco ISE packet issues in General Topics

Palo Alto and Cisco ISE packet issues

Carpetright — Fri, 02 Feb 2018 15:20:41 GMT

ive got an issue when a user connects on our VPN using the global protect client the connection will take nearly a minute to connect and in the backgroup create several failures on our Cisco ISE RADIUS server, before finally let the user connect.

I have got calls open with both Palo Alto and Cisco support but i kinda feel like im not getting anywhere, so i thought i would turn to the forums! Cisco seem to think the Palo Alto FW is not sending the packets as per RFC standards so therefore the Ciso ISE server is dropping the packets.

Throughout the ongoing support calls we have done packet captures and we can see that ISE is sending state and class attributes in access accept packet but state attribute (session identification attributes) is missing in the authorize-only request packet from the PaloAlto firewall hence ISE is not able to process the request.

If you have a Palo Alto FW and a Cisco ISE RADIUS server do get these issues?

Cheers

Re: Palo Alto and Cisco ISE packet issues

BPry — Fri, 02 Feb 2018 20:34:23 GMT

@Carpetright,

Just wondering if you've followed this configuration for using the Cisco ISE with a Palo Alto. You need to include a few VSAs to get everything working correctly.

https://live.paloaltonetworks.com/t5/Tutorials/Configure-Cisco-ISE-with-RADIUS-for-Palo-Alto-Networks/ta-p/145948

Re: Palo Alto and Cisco ISE packet issues

Carpetright — Mon, 05 Feb 2018 09:38:03 GMT

Yeah it was Cisco that mentioned about the VSA which have been changed but still not difference