Using ISE EAP-TLS with Machine cert, so my SAN in cert contains computer name.How can I use the Win username in an authorization policy to see if it belongs to a particular AD group ?
This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
Forum Posts
Resolved! Cisco ISE and IOT
Hello All,I am hoping someone can provide guidance and point me to the right direction. I am hoping someone with the same issue can provide some insight and clarification. I understand from the document below that we need "IOT visibility platform" . ...
Advanced Network Management is an IT consulting services company and Managed Service Provider, as well as, Gold Cisco Partner. We would like to request access to the Services API to be able to programmatically access our customers’ networks inventor...
Resolved! ISE Key Performance Metrics - Units?
Hi all,I'd like to get some more information on the key performance metrics (KPMs) in ISE ---- specifically, what units are they using to report some of the metrics?Specifically, how is "server load" calculated, and how is latency per request reporte...
Dear community, my customer is experiencing a problem with Windows 10 after the migration from ACS to ISE 2.7, patch 2.Windows 10 Clients (Version 1909) are using a built-in Windows Supplicant to get authentication via 802.1x to the wired and wireles...
Resolved! Cisco FTD FDM Access Control function
Hello!Imagine I have 1 client and 1 serverI create a rule that allows the client to talk to the DC on certain ports like dns, kerberos, ldap, time, rpc (135).Looks like this:client - ports = any -> DC - ports = dns, kerberos, ldap, time, rpc, etc Sin...
Resolved! ordering and designing for TACACS+
am i correct? for ordering the TACACS+ component for HA and VMware deployment 1. 2 units of R-ISE-VMS-K9. Cisco ISE Virtual Machine Small2. 2 units of L-ISE-TACACS-ND Cisco ISE Device Admin Node License i have 500 network devices. So how many Device ...
We used this request on Monitoring API to get the session active list: https://<ISEhost>/admin/API/mnt/Session/ActiveList Generally, we get about 11K active endpoints or MAC addresses from this active list. However, if we go to the Cisco ISE UI dashb...
Hello all, I have enabled DHCP Snooping with " ip verify source port-security" and it works without problem, but the issue is that the entries in the binding tables are not removed after a PC is disconnected so if a laptop user moves from a port to a...
Resolved! 802.1x on nexus 9000
I am currently configuring a simple 802.1x POC on a nexus 9K switch. The supplicant is a windows 10 and the Authentication Server is a Win Server 2016 running AD and NPS. I have everything working with another cisco L2/L3 switch but cannot get this w...
Hello I been busting my head for a while regarding this Problem. We habe an ISE with a policy allowing MAB devices to access the network. the Policy is using MAB wired and the authorization Profile is a VLAN download to the Switch for a Port(of wh...
Good Day, I currently have ISE 2.7 installed with Posture Policy set, in monitor mode. As of right now watching all the youtube videos, my understanding was when the device hits your Policy set > Authorization rule. It hits the posture complaint rule...
Resolved! Internal User Password Expiration Date
Does anyone know of a way to expose the internal user database password expiration date? It seems it should be trivial but not easily found. One use case for this request has to do with a number of "service" accounts with the same email. The password...
Resolved! ISE dual certificates
Hi All,a while ago I had to install a new ISE to handle clients that used another SSID with another certificate because the ISE could only use one certificate EAP-TLS for authentication. I need to add another SSID with another certificate now. Does a...
Resolved! Cisco ISE with Microsoft Always on
Is there is any way we can have ISE integrate with an always-on VPN? here is what I have in mind User John is part of HR, when he connects to the VPN he will get IP from 10.10.x.x User bob is Part of IT , he will get IP from 10.10.y.y the main reas...
