Hello,
so i have the following problem i have an Stealthwatch and ISE integration at the moment and is working, i can see the 802.1x users on ise and stealthwatch with the ip and mac address, in that way everything is working as spected but when i do the change over on the stealthwatch to the ANC-Policy that a specific users should use i got a problem on Cisco ISE and ARUBA switch.
as you can see in the picture above the error the i get is when i do the change on the stheatlwatch and then being send to the ARUBA switch but the aruba is not responding correctly to the request.(afeter that i do a manual COa and is working as spected)
After double checking i see that the Radius VSA that is being send is CISCO AV PAIR, as you can see below:
so the question: is ther a way to change that parameter from CISCO AV PAIR to just a normal COA port-bounce or shutdown instead?
because that the only thing not working on the implementation, DACL and manualy changing the ANC-Policy and then doing a manual port-bounce is working.
does anyone has any idea on how to do this?
thanks for the help.
ok i follow the Aruba manual that defines the parameters for a COA Re-authenticate or COA port bounce:
DACL’S AND VLAN ASSIGNMENT
this configuration where suggested on aruba comunnity(link bellow):
https://community.arubanetworks.com/discussion/coa-port-bounce-with-cisco-ise-and-aruba-2530#bm2e01654f-d7c4-4709-ac4d-d7099b805112
for RADIUS COA terminate:
and that the link before is for the parameter of Radius COA terminate.
THE PROBLEM:
but the problem lies on the following when i apply a change on the Stealthwatch, CISCO ISE allways send to the SWITCH the Cisco AV-PAIR VSA and aruba is now able to get the information from that VSA.
as suggested from @Nancy Saini i should be using a terminate because that a standar parameter thant being send:
this is a capture from the link that @Nancy Saini share before, but the problem is that ANC does not give that parameter at all to be chose as the action taken when the change is send from stealthwatch.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01100.html (ADAPTIVE NETWORK CONTROL MANUAL)
as you canse in here those are the 3 options and those use a Cisco only VSA.
so is there a way to define that when you do this change it should use the parameters define on the device profile specific configuration or not because everything else work, DACL and manual Port-bounce, termination from cisco ISE directly done, to the switch so the integratino is working but lets say with a extra step.
here how it should work:
https://www.youtube.com/watch?v=BAN3CaYsunw&t=141s
but insted you need to got to ENDPOINTS DASHBOARD and do the COA manualy.
i spect your comments thanks for the help.
