Network Access Control

Hi there, During our ISE deployment we are trying to fit two simple requirements: machine and user authentication as well as centralized Windows computer administration, however, it does not seem to be a standard way to meet such a simple scenario: U...

Hello Team,  Could you please help me understand the following note in the documentation   https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_011001.html Purge Older Operational Da...

Hello ,   this is our configuration in the compagny : -Cisco Ise 1.4 -Anyconnect 4.2.02075  -now we use Symantec 12.X   we wanna push Symantec 14.2 (build : 10.31 0100) , but it's not detected by anyconnect 4.2 and then no posture . i activate Symant...

Hi Team,    I am facing subjected error. this is new requirement to establish certificate based authentication wi-fi access. Kindly suggest on this.  Access Service DOTIX_WIFI Authentication Method EAP-TLS   11001 Received RADIUS Access-Request11017 ...

Hello,   Can someone help me understand how RADIUS/TACACS determine the primary AAA-Server is unreachable before fallback to secondary AAA-Server, is this based on a RADIUS or TACACS session or IP-reachability. If based on IP, how exatcly does that w...

I am in the process of upgrading my Cisco ISE distributed deployment. I have 2 PAN and 3 PSN in the deployment. I was reviewing the upgrade guide. I noticed that the upgrade guide states if your PSN is part of a group cluster, you must deregister the...

Hello, not sure if this is the right place to ask this question. I'm trying to implement MAB authentication using Meraki Wireless and Cisco ISE. The Meraki AP isn't sending the "Call-check" field in the radius attributes therefore can't match MAB aut...

Looking to move from LWA to CWA for wireless guest access. Have a separate DNS appliance with a subdomain it’s authoritative for: guest.example.com On the certificate side, we have a CN=ise.example.com and SAN=ise.example.com and *.example.com used c...

Hi All, I have a customer that need to authenticate and authorize endpoints using some advanced certificate fields like extended key usage, organization unit and much more without going to any other external identity source like AD , just from the ce...

Dear cisco team,My company is implementing CDA in the environment and I wanted to ask if CDA has its own logs that can be forwarded to a monitoring server like IBM QRadar. I know it can gather logs from other devices and forward them but does it has ...

Hi,   We have ISE 2.2 patch 10.We use PAP mschapv2 dot1x user authentication. When clients try login to their new laptop coming from IT departmant they get the following error; We can't sign you in with this credential because your domain isn't avail...

Hi Team, I have catalyst 3650-24p-pdm with dot1x enable for multiauth, after reloading the switch, all IPPHONE failed to dot1x authentication and go to mab, even if the priority is set to dot1x and even after increasing the timeout/retries. if I shut...

Hi   I am trying to upload offline as well online the latest ISE Profiler Feed update to an ISE 2.4 Patch2 deployment. Both methods are failing and currently investigating the root cause with TAC. While troubleshooting we've observed that the Profile...

How is the rescan configuration on the AD profiler supposed to work?  I have the following shown under an endpoint:   AD-Fetch-Host-Name MININT-2JIERJF$   MININT hostname is used during WinPE phase of an SCCM build process.  So ISE learned that name ...

Hello, Can someone please explain why an IP-phone shows as data instead of VOICE   Device#sho authentication sessionsInterface MAC Address Method Domain Status Fg Session ID-----------------------------------------------------------------------------...