Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Attila Horvath
Attila Horvath
Beginner
Works as Network Engineer at a Cisco silver partner in Hungary, Budapest
Recent Badges
Stats
Member since
05-28-2009
87
Posts
20
Helpful
5
Solutions
Created by
Attila Horvath
in Policy and Access
in Policy and Access
06-28-2016
07:51 AM
06-28-2016
07:51 AM
Hi,
We are implementing EAP-chaining authentication with ISE 2.0 and Anyconnect 4.2.04018 clients (with NAM module).
Everything works like a charm, but some windows7 destop machine have an issue with posture.
When workstation started, the switch shows the succesful machine authetication (host/machinename as username).
After logging in to system, I can see the switch shows the username instead of machine name,
but the posture started (and posted to ISE) with machine name.
Of course it is an empty posure list as machina has not any requirement.
Whats wrong with it?
Br Attila
... View more
- Tags:
- ISE NAC posture
Labels:
02-25-2016
08:11 AM
Hi,
Could you solve the problem? He have a very same situation, with Anchor-Foreign WLC and with LWA.
Every time user device wnet to sleep, need to authenticate again.
... View more
Created by
Attila Horvath
in Policy and Access
in Policy and Access
11-11-2015
12:35 AM
11-11-2015
12:35 AM
Hi,
We would like to connect our corporate tablets and mobile devices to a restricted network - without implementing classic BYOD features like
self-provisioning but with certificate based only authentication (EAP-TLS).
(Our Helpdesk will handle the certificate install, wireless network set, etc.)
The WLC side is configured to handle the TLS, and now we try to generate certificates. To Ipad, to Android (Galaxy Tab 3 KITKAT), and to iphone.
Is there any special certificate requirements to implement this?
What should certificate EKU field contain?
... View more
Labels:
11-08-2015
10:50 AM
But how can I make sure that the certificate is valid and offered by a valid CA ?
... View more
11-05-2015
01:28 PM
Have you tried to set "ip host" at PSN CLI?
http://d2zmdbbm9feqrf.cloudfront.net/2015/anz/pdf/BRKSEC-3697.pdf
You must use an alias to a local address
ip host <local addr><local FQDN> <Public FQDN>
ise-psn1/admin(config)# ip host 10.1.91.5 ise-psn1-guest ise-psn1-guest.company.com
... View more
Created by
Attila Horvath
in Policy and Access
in Policy and Access
11-05-2015
01:04 PM
11-05-2015
01:04 PM
Hi,
We would like to implement the following:
Corporate (not private) Tablet and mobile devices (Ipad, Android) can connect to corporate wireless SSID with certificate installed on it,
but without AD membership, so certificates exist only at PKI server. (of course the auth is based only certificate - TLS)
I know the BYOD is very same, but - as I understand - the final stage, after the CoA is a simple certificate based authentication from AD.
Is it possible to implement it without AD? The certificate provisioning is a Helpdesk task, not user controlled.
TIA
Attila
... View more
- Tags:
- ISE TLS PKI
Labels:
11-05-2015
07:06 AM
Just to note, the trouble caused by a firewall (Zorp) between NAD and ISE node.
Now (we change the rule at firewall to a simplest one) we can see more than 64 entries sent by ISE to NAD.
... View more
Created by
Attila Horvath
in Policy and Access
in Policy and Access
09-28-2015
05:49 AM
09-28-2015
05:49 AM
Hi, Is there any limitation for DACL entries (or size) when Cisco ASA 5515 (ver 9.2(4) connect to ISE 1.4 ? We saw a 24 (!) entry limit in practice, but cannot found any written value from cisco. Is there? Attila Horvath
... View more
- Tags:
- #ise #asa #dacl
Labels:
Created by
Attila Horvath
in IP Telephony and Phones
in IP Telephony and Phones
05-27-2015
04:40 AM
05-27-2015
04:40 AM
Hi, It seemed to me, it was not forced. Now I checked, and works like a charm ;) Thanks a lot!
... View more
Created by
Attila Horvath
in IP Telephony and Phones
in IP Telephony and Phones
05-26-2015
02:01 AM
05-26-2015
02:01 AM
Hi, For call forwarding issue, it is solved by force the codec to g711u. The wrong settings was to allow any codec, and the Alcatel's offered codec was refused by the PSTN gateway. For MOH issue : - the trunk have MRGL with MOH server included (all of is the CUCM itself) - the codec is g711u - the MOH is unicast, as it will be a very simple implementation - I am not sure I was tested the MTP forcing? Where can I do it? Attila
... View more
Created by
Attila Horvath
in IP Telephony and Phones
in IP Telephony and Phones
05-22-2015
03:31 AM
05-22-2015
03:31 AM
Hi, We have connected a CUCMv10.5 to an Alcatel PBX with SIP based on this document: http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/unified-meetingplace/1001103.pdf (ALCATEL) == sip trunk == CUCM == h323 trunk ==Cisco vgw - (PSTN) Most thing goes well, except two: -MoH When a call is goes from Alcatel , and the Cisco side SIPUA agent is put it on HOLD, the Alcatel side cannot hear the music. Inside of CUCM it is works, also works when the call is come from a H323 gateway. - Forwarded calls (see call2.png for call flow) The bigger problem is the forwarded calls. When the call goes from Alcatel, and at the CUCM there is a Call Forward set to a mobile number (via h323 gw), the call is goes out, ring once (or shorter), and the call is ended with normal call clearing. Tried to debug the sdl, but cannot found any error. What caused this? Some calling timeout?
... View more
Labels:
Created by
Attila Horvath
in IP Telephony and Phones
in IP Telephony and Phones
05-18-2015
09:25 AM
05-18-2015
09:25 AM
Hi Rob, I am afraid this is my problem ;( But what I have to configure to work the scenario above (initial announcement with custom file)? Ann is configured, and shows as registered, but still does not work. I missed something?
... View more
Created by
Attila Horvath
in IP Telephony and Phones
in IP Telephony and Phones
05-18-2015
06:26 AM
05-18-2015
06:26 AM
Hi, Tried to setup the announcement for a queue type hunt pilot. At "initial Announcement for queuing-enabled Hunt Pilot calls" I set the "Play annoncement before..." enty to play a wav file before handle the queue call. I upload the announcement files, with locale set to "Hungary" and also with English. The newest locale file is installed in system. So the problem is: When I want to use the " Announcement by Locale" feature with my own sound file, it does not play the initial announcement, not from called inside nor outside. When I use the Cisco"s pre-defined "Default Announcement", it works well. Summa summarum, I cannot use my own recorded sound file for initial playing. The interesting thing is that "Periodic Announcement" (when the queue is full) is works well with (all of) custom sound files, so it is not transcoding error. Is it a bug? I cannot find anything at Bug search...
... View more
Labels:
Created by
Attila Horvath
in Voice Systems
in Voice Systems
02-16-2015
08:41 AM
02-16-2015
08:41 AM
Hi, We need to provision hundred of SPA5xx phones to a non-cisco softswitch via SIP protocol, in hard Cisco Callmanager enviroment (distributed, with several Callmanager in LAN). Because we want zero-touch installation, we need to ensure that the phones will NOT FIND the Callmanager via SPCP, based on our plans it will find a SIP server via option 66 tftp server IP. As by default SPCP is enabled, the wireshark traces shows me the factory-default phones searches the SEP** and XmlDefault*** files in the subnet. But one of traces show the phones find these files at Default gateway IP, other traces shows the phone tried to access the DNS server ip , and so on. Anyone knows the exact protocol? What IP's will these zero-configuration phones be search after boot, with or without option 66 set? Tried to find an SPCP RFC, but not found. Any tips are welcome ;) Attila
... View more
Labels:
Created by
Attila Horvath
in Cisco Bug Discussions
in Cisco Bug Discussions
01-19-2015
03:47 AM
01-19-2015
03:47 AM
Hi, tried to solve the SSLv3 POODLE vulnerability at CUCM 9.1(2), but it shows the following as FIXED versions: 10.5(1)ES98 10.5(1.12021.1) 10.5(1.98050.103) 10.5(2)ES3 10.5(2.178) 10.5(2.179) What about with version 9.1(2)? We need to upgrade to 10.x ? Or wait fixing for this version? Attila
... View more
Labels:
You Have No Messages
Public Statistics
| Date Registered | 05-28-2009 01:34 AM |
| Date Last Visited | 05-09-2019 03:02 AM |
| Total Messages Posted | 87 |
| Total Helpful Votes Received | 20 |
