Hi ,I am trying to build a policy to authenticate both Machine's MAC + The user should be a member of a special group in AD . I AM NOT USING 802.1X in my setup . My NAD is an ASA .the user authentication is already done , I just want to know how to ...
This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other troubleshooting best practices.
Forum Posts
Hello Experts,I would like to extract reports based on the TLS version being used by the endpoints, as seen here:But, was not able to locate such a filter on ISE Reporting, any pointers to the same?Or is this something that cannot be extracted from I...
I have configured RADIUS on a set of new Nexus 9K's and for some reason I cannot get it to use the correct vrf for connections. Here are my configs and the error I get.aaa group server radius xxxradiusserver 192.168.2.20server 192.168.2.21server 192....
Hi,Since DNA Center managed Network Device.The ISE generate a lot of DNAC login raduis log.Can someone give advice?The attachments are the version and radius logs.
Resolved! ISE - Dynamic Variable Substitution
I have been reading up on Dynamic Variable Substitution within ISE. I have seen how the VLAN can be dynamically set. I see that there are 2 to 3 av-pairs that need to be set: sgt-name, security-group-tag and vn.Is it possible to set the Security Gr...
Hello All - I would like to understand the functionality of each CoA type available for a live session. The ISE live logs as wells as the tcpdump has specific CiscoAVpair messages associated to each type. Here are my findings, CoA Session Reauthcomma...
Resolved! Cisco ISE warning license after upgrade 2.2 to 2.6 ""Please contact your Cisco Sales Representative"
Hi,I just upgraded a Cisco ISE from version 2.2 to version 2.6 and just after updating a window appears with a warning message saying " Please contact your Cisco Sales Representative "Do you know what is due and how to fix it?Thanks
I am having a problem with re-connecting ISE Threat Centric NAC to the the AMP Cloud. It was working and then couldn't connect. So eventually I removed the connector and recreated it. Now when I try to complete the configuration to reconnect it fails...
Resolved! Does the ASA need SXP to act on SGTs?
I have been successful at connecting an ASA to ISE just by adding a PAC file in the ASA. The ASA is then able to get an SGT and see where ISE assigns the SGT in the session. Do I even need to continue using SXP? I have configured it successfully alth...
Hello.I have just built 2 x ISE-2.4.0.357-6.5OVA-Eval.ova appliances in HA to test out some configurations that I will be doing for a customer shortly. Trying to configure TACACS Cisco Switches authentication administration but not able to.As per thi...
Resolved! IOS-XE 16.9 Code Portal Redirect + DACL
I am seeing an odd issue that I will probably open a TAC case on. I have the following portal redirect ACL: Extended IP access list PORTAL-REDIRECT10 permit tcp any host 10.0.0.1 eq www20 deny ip any any That ACL should only redirect port 80 tra...
Hi ,I am deploying ISE posture 2.6 using ( Modules = anyconnect vpn + ISE posture ) from vpn users via CISCO ASA , My only problem here is that I am obliged to install the PostureprofileCFG on the endpoint otherwise it will not work , I don't get how...
How does ISE handle a certificate presented for endpoint authentication where the certificate is in an 'on-hold' state? With this be treated the same as if the certificate was expired? Thanks, Joe
Customer is asking for sample ISE reports showing the details available with postured/profiled devices. Do we have any reports that we can share?
Hi, What I want to implement (which was implemented in the pst using Windows 7 and Microsoft NPS) is this: (at least for the very beginning) I'd like Dot1x authentication to do a simple task for me: Only allow windows 10 clients to be connected to th...
