Traffic Forwarding Strategies for Cisco ISE

This document defines how authentication traffic should be forwarded in hybrid WAN and SD-WAN environments.

---

1. Authentication Traffic Characteristics

• Control-plane traffic

• Highly latency and jitter sensitive

• Stateful (EAP, posture)

RADIUS ≠ data traffic

---

2. Good Pattern – Local Authentication

2.1 Characteristics

• Deterministic path

• Low RTT

• No WAN hairpinning

3. Bad Pattern

• Hub-and-Spoke Authentication

3.1 Observed Issues

• Increased jitter

• EAP instability

• Posture oscillation

4. SD-WAN Policy Design (Conceptual)

4.1 Match

• UDP 1812 / 1813 (RADIUS)

• TCP 443 (Posture)

• TCP 49 (TACACS, if used)

4.2 Actions

• Strict SLA

• Prefer local transport

• No cloud security insertion

• Avoid FEC for authentication traffic

5. Multi-Region Example (BR ↔ US)

Flow	Valid
NAD-BR → PSN-BR	Yes
PSN-BR → DC-BR	Yes
NAD-BR → PSN-US	No
Auth via global hub	No

6.1 Real-World Scenario

6.1 Topology

• NAD: São Paulo

• PSN: AWS us-east-1

• DC: On-prem São Paulo

6.2 Measured RTT

• NAD ↔ PSN: 160 ms

• PSN ↔ DC: 180 ms

6.3 Symptoms

• EAP-TLS failures under load

• RADIUS retransmits

• Posture stuck in Unknown

Key Takeaway

Authentication traffic must be explicitly engineered. Leaving it to generic routing decisions leads to unpredictable behavior.

---