topic Re: ISE with Cisco 2950G//SNMP COA in Network Access Control

ISE with Cisco 2950G//SNMP COA

hasitha siriwardhana — Thu, 22 Feb 2018 13:33:48 GMT

Hi Team,

In network where cisco old switches like 2950G is there , how can we deployed ISE.

Even the new cisco ISE 2.3 doesnt need redirect, there are concerns with radius COA. Since they are not supporting Radius COA.

So we tried SNMP COA, but even that is not working.

So what are the alternatives.

Regards

hasitha

Re: ISE with Cisco 2950G//SNMP COA

Nidhi — Thu, 22 Feb 2018 15:08:03 GMT

Due to a defect on Cisco switches, SNMP coa is currently not supported.

Expecting a fix soon for this.

Thanks,

Nidhi

Re: ISE with Cisco 2950G//SNMP COA

Craig Hyps — Thu, 22 Feb 2018 17:02:26 GMT

Bit of clarification...

There is no defect on Cisco switches. The manner in which SNMP CoA was originally implemented was to send both port down and up in a single SNMP request. The Cisco switches are actually a bit more intelligent and logic states "only apply the last change for same SNMP object". The resolution is to provide option to send separate shut/no-shut directives to switch. This enhancement is coming in ISE 2.4.