Symptom

Topology: VPN client ASA IPEP PSN (proxy) external RADIUS. IPEP is proxying Radius requests from the ASA to the PSN and hence inserts a proxy state attribute in request. PSN configured in proxy mode and doing authentication against external RADIUS server hence inserts another proxy state attribute. When reply is received from external RADIUS PSN must remove own proxy state attribute before passing it back to IPEP, instead it removes both own and IPEP proxy attributes, hence authorization on IPEP fails.

Conditions

ISE VPN IPEP deployment with PSN configured in proxy mode.

Workaround

N/A

Further Problem Description