Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About hslai
Stats
Member since
12-03-2009
3367
Posts
1579
Helpful
1098
Solutions
08-21-2019
07:34 PM
This is due to switch platform support so I moved it to Switching.
CSCuv27265 in Caveats Resolved in Cisco IOS Release 15.2(4)E2 is for HTTP support only so I do not think this platform supporting TLS 1.2 on EAP yet.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
08-11-2019
03:58 PM
08-11-2019
03:58 PM
In the certificate authentication profile used to authenticate your endpoints, ensure "Identity Store" is set to "[not applicable]" if no need to resolve the identity ambiguity or to perform binary comparison of the certificates. To check the issuer, then we may add an authorization condition on the CERTIFICATE.Issuer. To check the validation, add a condition on CERTIFICATE.Days to Expiry or the like.
First of all, in order to check certificates in AD/LDAP, the endpoint certificates need stored in the user/computer objects in the AD/LDAP. At present, in order to use Azure AD as an external ID store in ISE, other than as a SAML IdP, we need Azure AD Domain Services enabled in Azure AD directory. For hybrid organizations using Azure AD Connect to synchronize with the on-prem directory, we should be able to integrate ISE with the on-prem directory. Otherwise, you may try Configure secure LDAP (LDAPS) in an Azure AD Domain Services domain.
... View more
Created by
hslai
in Security Discussions
in Security Discussions
08-06-2019
10:16 AM
08-06-2019
10:16 AM
I would suggest you to try using a certificate to authenticate. And, will also ask John to take a look.
PS: I moved your discussion to the security developer support forum for DevNet.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
07-29-2019
10:00 AM
07-29-2019
10:00 AM
ISE is not supporting to use SAML IdP to authorize EAP-TLS.
SAML applies to Web applications or interfaces only. At present, ISE supports it for Web-based authentications of end-user facing portals, such as ISE guest portals. When using SAML IdP, it is exclusive; i.e. either SAML IdP only or no SAML IdP. The workaround is to use two web portals.
... View more
07-27-2019
05:40 PM
Not I know of. I moved your discussion to Switching, as your inquiry is specific to an IE1000 feature.
... View more
07-26-2019
08:53 AM
I've moved your discussion to Routing as the only Cisco element in your network is a router.
As both the switch and the RADIUS server is of HP, I would suggest you to check with HPE support resources if you have not done so already. The MacSec has some potential but you need to verify whether the switch and the router have compatible support.
... View more
Created by
hslai
in Wireless Security and Network Management
in Wireless Security and Network Management
07-26-2019
08:15 AM
07-26-2019
08:15 AM
I moved your discussion to Wireless Security and Network Management as your inquiry is specific to Mobility Express.
... View more
07-26-2019
08:08 AM
I moved your discussion to Routing as NCS 540 is a Cisco router and your inquiry is specific to that platform.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
07-24-2019
08:25 PM
07-24-2019
08:25 PM
Another question is what for are Crypto Keys that are store on switch? what is Self-Signed-Certificate for?
See A self-signed certificate is added to a... - Cisco Community
... View more
Created by
hslai
in Policy and Access
in Policy and Access
07-24-2019
08:23 PM
07-24-2019
08:23 PM
... Is possible to determine where from keys are coming by looking at keys? I have snapshot of accept /deny access.
See Calculating a SSH Fingerprint From a (Cisco) Public Key | Didier Stevens
... View more
Created by
hslai
in Wireless Security and Network Management
in Wireless Security and Network Management
07-24-2019
07:36 PM
07-24-2019
07:36 PM
As your question is specific to 9800 WLC, I moved it to Wireless Security and Network Management
I am not finding any info about it would not work so far so it might be best for you to try AAA Configuration for AVC Profile to a 9800 in your lab or dCloud.
... View more
07-22-2019
08:33 PM
It seems you are trying to perform device administration (allowing a network admin to login to the switch) via RADIUS and that might not have supported on this platform. I would suggest you to try testing 802.1X or MAB against your RADIUS server. If you want to try T+, I would suggest you to try Identity Services Engine (ISE).
... View more
Created by
hslai
in Other Service Provider Subjects
in Other Service Provider Subjects
07-22-2019
07:25 PM
07-22-2019
07:25 PM
I moved your post under Service Providers > Other Service Provider Subjects as this product is gears towards Service Providers and not supported by our teams monitoring the forum on policy and access.
If you are not getting responses, I would suggest you to try internal support resources.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
07-22-2019
07:03 PM
07-22-2019
07:03 PM
Those omitted are not really the crypto key info needed for SSH. I tried zero it out on a 3650 in our lab and regenerated the key pair and the crypto section of the run configuration remained the same.
crypto key generate rsa says,
...
This command is not saved in the router configuration; however, the RSA keys generated by this command are saved in the private configuration in NVRAM (which is never displayed to the user or backed up to another device) the next time the configuration is written to NVRAM.
...
... View more
Created by
hslai
in Identity Services Engine (ISE)
09-03-2019
09-03-2019
What you described is not yet supported. See CSCvm01451 ENH: Read-Only
Access to Policy Set's while ...
Created by
hslai
in Identity Services Engine (ISE)
09-03-2019
09-03-2019
General support since ISE 2.1.Some known issues; e.g. CSCvp09698
Failling profling query due to no N...
Created by
hslai
in Identity Services Engine (ISE)
09-03-2019
09-03-2019
Use either a posture Dictionary Compound Condition (ISE Admin Web >
Policy > Policy Elements > Condi...
Created by
hslai
in Identity Services Engine (ISE)
09-03-2019
09-03-2019
Fresh install from the ISE 2.4 Install ISO medium will get blocked.
Upgrade not prevented due to kno...
Created by
hslai
in Identity Services Engine (ISE)
08-21-2019
08-21-2019
Yes. We usually add another condition -- Session·Device-OS Equals
Android -- in the Policy rule 1.
Created by
hslai
in Identity Services Engine (ISE)
08-21-2019
08-21-2019
Unfortunately, this is not possible today. Please give the feedbacks to
Apple as this really relies ...
Created by
hslai
in Identity Services Engine (ISE)
08-21-2019
08-21-2019
I already responded this offline. A quick re-cap. 1. Yes 2. To use the
button "Configure WMI" requir...
08-21-2019
This is due to switch platform support so I moved it to Switching.
CSCuv27265 in Caveats Resolved in...
Created by
hslai
in Identity Services Engine (ISE)
08-21-2019
08-21-2019
You are correct regarding how the current enforcement works. Today ISE
generates alarms if any licen...
Created by
hslai
in Identity Services Engine (ISE)
08-20-2019
08-20-2019
On Q1, CFG restores do not provide valid licenses. So, please re-host
the licenses at Cisco Licensin...
08-20-2019
Requirements for domain controller certificates from a third-party CA
shows to include the domain co...
Created by
hslai
in Identity Services Engine (ISE)
08-17-2019
08-17-2019
I will suggest to emulate what a load balancer doing by ping and test
authentication probes to monit...
Public Statistics
| Date Registered | 12-03-2009 07:31 AM |
| Date Last Visited | |
| Total Messages Posted | 3,367 |
| Total Helpful Votes Received | 1579 |
.jpg "VIP Engager"){kind=icon}
Helpful Votes From
