topic Re: Profiling Cisco 8865 on ISE in Network Access Control

Profiling Cisco 8865 on ISE

Pulkit Nagpal — Mon, 21 Aug 2017 03:01:46 GMT

Hello Experts,

My customer is going to replace their existing DX-650 phones with Cisco 8865 phones for VPN home phone setup. They were using device-type information from radius authentication packet for creating policy on ISE. To be specific, they were using using device type field as below:

Cisco 8865 is not sending any such such unique "ciscoavpair" attribute that can be used in this case. Can you suggest an alternative please?

Thanks & Regards,

Pulkit

Re: Profiling Cisco 8865 on ISE

ognyan.totev — Tue, 22 Aug 2017 05:37:02 GMT

Ok we see what is the switch information about DX-650 but give us some log what u see when u connect Cisco 8865

Re: Profiling Cisco 8865 on ISE

Nidhi — Tue, 22 Aug 2017 05:53:56 GMT

This is from the 8865 deployment guide -

" The Cisco IP Phone 8861 and 8865 currently support automatic provisioning of the PAC only, so enable Allow anonymous inband PAC provisioning on the RADIUS server as shown below. Both EAP-GTC and EAP-MSCHAPv2 must be enabled when Allow anonymous in-band PAC provisioning is enabled. "

You might want to follow the document at https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/cuipph/8841_8851_8861/10_5/english/DeploymentGuide/CiscoIPPhone8…

Re: Profiling Cisco 8865 on ISE

hslai — Tue, 22 Aug 2017 17:33:01 GMT

The device-type is part of AnyConnect Identity Extensions (ACIDEX) supported in ISE 1.3+, ASA 9.2.1+ and AnyConnect 3.1MR5+ for desktop OS's, Android, and Apple iOS. Please consult the phone platform support team whether it has this particular AnyConnect VPN feature.