New NAC design. Call center is currently using VMPS for dynamic VLAN assignment (6509 running hybrid CatOS and IOS, YUK!!!). Requirements that PCs (aka users) are assigned to specific VLANs that limit what resources they have access to. Unregistered MAC addresses go into "penalty box" Visitor VLAN with internet access only. LAN currently spans three levels in a building with core 6509s. Core, distribution and access are all Layer 2, with the 6509s centrally routing everything (will be updating this for them later). NAC must not be a bottleneck for users that are authenticated or trusted. At first I'm thinking Layer 2 OOB. They want a NAC Guest server to control the access to the visitor vlan and possibly use with WLC for Visitor access as well. Based on this information I would think that I would want to use layer 3 OOB with real-ip gateway and create a new authentication VLAN for the untrusted side of the NAC server and assign the trusted VLAN based on the roles (mac addresses) defined in the NAC manager to replace the VMPS functionality. They also use non Cisco based VoIP. I'm guessing I can address that simply by having a list of all the mac addresses of the IP phones on the ignore list on the NAC manager. Any suggestions or pointers? They do not want to address the core, distribution and access architecture at this time.
Threat Response integrates with Cisco's Web Security Appliance (WSA) to provide visibility into web-bourne threats. By adding a Web Security or SMA Web module to Threat Response, investigators will be able to search for domains, URLs, and file hashes th...
I was helping some friends and they were trying to solve a scalable VPN issues, specially these days with the pandemic situation.
I recommended to implement ASA VPN Load-Balancing.
This will allow to keep 1 FQDN for all RA-VPN users an...
Purpose of this article is to share our experience during that Covid-19 period where we were able to successfully setup a VPN configuration for remote worker using Alcatel 8068S phones with FTD 2110 running 18.104.22.168.I would like to thank all of my colleagu...
For additional advanced ISE related Tips, please visit Advanced ISE tips to make your deployment easier document
Downloadable URL-Redirect ACL
If you have ever configured CWA (Central Web Authentication) with ISE you understand that it requires on...
Cisco Defense Orchestrator (CDO) is a cloud-based multi-device manager that can manage security products like the Adaptive Security Appliance (ASA), the Firepower Threat Defense next-generation firewall, and Meraki devices, to name a few.&nb...