Hello 802.1X (switch) experts, I deal mostly with WLC deployments and Session-Timeout is configured globally on the WLAN profile and applies to all authenticated sessions (unless over-ridden by AAA Override). Is there a similar concept on Cisco s...
This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
Forum Posts
Hello, We are planning to change the release of ISE from 2.0 to 2.4 and there are some license issues that we need to clarify. The deployment has Wired, Wireless, VPN and Device Admin licenses. The goals of the change are to be able to use the same f...
Hi, I am running into an issue where ISE is unable to get the certificate issued from an external CA. All ISE certificates are issued by this CA and normal authentication with and without certificates are working. However during BYOD on-boarding, i...
We have ISE PSN nodes in a DMZ guest access scenario and do not want them joined to the AD.Is there any way to disable the AD join for specific ISE nodes while allowing it for others?Cheers
Hi all, Just a quick question to get my head around the ISE version numbers. We're running 2.4 patch 3 at present so my install says 2.4(0.357) Patch 3. If I go to Patch 5 I expect it to say 2.4(0.357) Patch 5. That makes sense to me. Reading up on s...
Resolved! LDAP on ASA with attribute-map
Hi all,I'm having problems configuring VPN clients authentication against an LDAP server. The main problem is when the ASA has to decide a group-policy for the non-compliance users.I use LDAP attribute-maps in the ASA to map the memberOf parameter t...
I am running ISE 2.4 (Tacacs Feature) Patches 1 to 5.I am using the ISE ERS API to add a Network Device. Is there a way to check if the ip address already exist before trying to add the device? I know how to check if a device already exists, but I c...
Hello, I am trying to migrate a network from Mikrotik CRS switches to Cisco Catalyst switches but i cannot find the MAC based VLAN (https://wiki.mikrotik.com/wiki/Manual:CRS1xx/2xx_series_switches_examples#MAC_Based_VLAN)feature that is provided by M...
I am running ISE 2.4 (patches 1 to 5) with Tacacs+ enabled . I am trying to add a Network Device Group using the REST API. I am doing the tests with Postman.I am reproducing the example found in the "External RESTful Services (ERS) Online SDK" API Do...
We have a fresh deployment of wired NAC and would like to have Access Switches send authentication requests to each of our data centers where each has a load balancer with 11 PSN's so it's a fairly large deployment. I thought the configuration was st...
Resolved! Cisco ASA-55xx NG IDFW CDA Alternative
Hi All, I am looking to implement IDFW on the network using Cisco ASA 55xx NG appliances. I understand the Context Directory Agent is not supported on ESXi 5.5 upwards and also potential support issues with Windows 2012 too. Looking at the download...
Resolved! Integrate Meraki AP's with ISE
I plan to integrate Meraki AP's into ISE. I need to add the Meraki AP's as network devices to ISE. Assuming the AP's are on the same subnet couldn't I simply create a single network device in ISE for the AP's and use a subnet address for them instead...
Resolved! ISE downgrade from V2.3.6 to V2.3.
Hi expert, My customer will plan to upgrde the ISE from V2.3 to V2.3.6. They would like to know If the upgrade fail, Is there downgrade guide? or should they re-image the ISE to the V2.3 and restore the configuration(V2.3)? I am looking forward to ...
Are there are best practices around using ISE with source-guard, since source-guard will apply a port ACL, what do we recommend in terms of deployment in these cases?
Hello , I'm trying to configure the dot1x timeout in the global config , I have been verified the command reference guide for 15.2 IOS in 2960X switches and is possible to configure globally but when I try to configure the command dot1x timeout tx-p...
