a network device can be part of multiple device group in ISE ? I want to see if it is possible for example if a device can be part of group 1 and group 2 at the same time ?
This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
Forum Posts
Consider this is a TEAP setup. For a NAC enabled machine - if a user 1st time connects to the network that user need to get the Device cert while it connects to the network. After Device cert is pushed from Intune it should be re-authorized with EAP-...
Hello,I am trying to retrieve from Cisco ISE the number of sessions/endpoints that are using a specific authorization profile.Specifically, I want to find out how many endpoints are currently assigned the “Blocked” authorization profile, and then gen...
after an upgrade from 2.7 to 3.3 p4 im trying to do posture, and a PC that already in the database connects and gets to compliant but for some reason is not changing the Quarantine vlan for the new one. The authorization rule sets a DACL and a new vl...
CSCwh73915 - Static IP Assignment not working using attribute msRADIUSFramedIPAddress when posture is enabled.Solution:We can assign static IP, if we use parameter radius ip address= msRADIUSFramedIPAddress in Posture unknown authorization profile....
Hi, im having a problem. See picture above. Im building as my thesis work a Cisco ISE automated access control and what i have understood, the Edge-switches should be L2 Access switches but im having a difficult time with Edges. Im using ISIS between...
problem with iPhone guest authentication with cisco ISE aswhile we use the Wifi Guest SSID the redirection page opens for a second thensuddenly closes, while we've android phones and IPads that authenticate normally.ISE 3.3 Patch 2 WLC 9800-Ldoes any...
Resolved! NAC Guest VLAN not working as expected
Hello,I am doing a lab with hardware (c112X router using the switch module) with IEEE 802.1X and MAB. I am trying to achieve the following fail-over process that Cisco describes on this document:https://www.cisco.com/c/en/us/support/docs/lan-switchin...
I have been investigating this issue for a while now. I have about 20-30 different switchports around my campus where thousands of bogus mac addresses show up in ISE attached to specific ports. We're talking about MACs like '00:00:00:00:00:01'. Ones ...
Resolved! Cisco and FortiNAC
We test dynamic vlan using fortinac and example fortinac decided assign vlan 230 to the workstation and yes the workstation get ip from vlan 230. The strange is when i check the port switch configuration, there is no switchport access vlan 230. How t...
Hi experts,I have a cert OCSP nearly expired (#0004) but cannot renew or do something with that.If i choose Renew ISE OCSP Responder Certificates the system will generate a cert #00027 (picture) issued by Certificate Services Endpoint Sub CA - ise-pr...
Resolved! Need to configure SNMP v3 in ISE 3.0
Hi, I would like to monitor Cisco ISE via solarwinds and need to enable SNMP v3 on ISE. Can anyone help with the commands for 3.0 . I tried with below commands, but it as king remote engine ID. What it will be? ise-mgt01/admin(config)# snmp-server ho...
Dear community, I recently setup a RAVPN using the Secure Client and an ISE deployment for authentication and posture. It works as expected for our corporate devices, but I have an issue with posture for non-corporate machines, like a linux desktop. ...
Resolved! ISE - Routing Multiple Interfaces
Hi, I have ISE medium deployment. 2 PAN & MnT and 2 PSNs. I have configured BYOD and Posture on PSNs. I configured Gi 1 interface with different IP address which should be used for BYOD and Posture portals. My question is regarding routing. How ISE h...
Resolved! Split-tunnel acl vs ISE DACL
Hello,I had a quick question. So currently we have a tunnel-group-name condition configured on ISE so whoever connects to this vpn tunnel-group then gets a permit ip any any DACL.If split-tunnelling is used which is evaluated first? Im assuming the D...
