Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About hslai
hslai
Member since
12-03-2009
Cisco Employee
07-15-2019
08:31 PM
Try checking the system log events around the time of export by using ISE admin CLI command "show logging system ade/ADE.log". If you need further help in troubleshooting it, please open a Cisco TAC case.
BTW... ISE 2.3 has this new feature Reports Export Summary. You can't make use of it because your ISE still 2.2.
... View more
07-15-2019
08:22 PM
T+ authentication and authorization are two separate events. We should see something like below:
If that is not similar to yours, you might need to engage Cisco TAC to troubleshoot.
In ISE 2.3+, we do also see Selected Authorization Profile in the details report for the authentication event. That is to compensate some login security issue with NX-OS.
... View more
Created by
hslai
in Cisco Bug Discussions
in Cisco Bug Discussions
07-04-2019
10:21 AM
07-04-2019
10:21 AM
CSCvp75207 is due to another bug fix in ISE 2.4 Patch 8 but NOT resolved in ISE 2.4 Patch 9.
However, the issue documented by CSCut26025 is not related at all to CSCvp75207.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
07-03-2019
08:20 PM
07-03-2019
08:20 PM
No tool that I know of to compare ISE policies. You could try exporting the policies out at ISE admin web UI > Administration > System > Backup & Restore > Policy Export.
I just noticed that your setup is not a norm, because the same set of the switch interface and PC network connection are used by ISE as well as the test client. Thus, the switch is likely considering the RADIUS is dead for some time.
I would suggest to get another wired adapter on your machine so that ISE may use its own connection to a switch interface not doing authentication, and the test client has its own as well to connect to a 802.1X enforced switch port, if you are unable to find another machine to serve as the test client.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
07-02-2019
04:18 PM
07-02-2019
04:18 PM
If PAP is insecure why is it commonly the only authentication protocol available for Radius? - Information Security Stack Exchange is an interesting read to me.
... View more
07-01-2019
02:40 PM
I moved your post to VPN and AnyConnect, as your question is more on AnyConnect deployment.
If all clients are connected to a network controlled and postured by ISE, then you may use the web deploy option from ISE. This is not a scalable solution but might work if not too many clients doing it the same time.
For pre-deploy, I believe customers usually use SCCM or the like. I am not sure it doable via GPO. Please consult Deploy AnyConnect
... View more
Created by
hslai
in Wireless Security and Network Management
in Wireless Security and Network Management
06-30-2019
08:26 AM
06-30-2019
08:26 AM
I moved your post to Wireless Security and Network Management, because the doc is created by our wireless teams.
The two particular tables seem no longer being updated, as the converged access solution/software is not available in later IOS-XE releases. I would suggest you to start looking into Cisco Catalyst 9800 Series Wireless Controllers.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
06-29-2019
10:23 PM
06-29-2019
10:23 PM
I concur with Mohammed al Baqari and Mike.Cifelli.
You may also take a look at Data collection for troubleshooting 802.1X authentication and Collect Debugs From Wireless LAN Controller (WLC)
... View more
06-29-2019
10:05 PM
Please do continue on the other post at NAM & ActivClient Issue. If you are unable to provide a DART bundle requested there, then do it through the regular Cisco TAC support process.
... View more
06-29-2019
09:58 PM
I hope you have already engaged Cisco TAC support by now.
If you are still in the same state and trying to resolving it yourself, then adding to the others..
You could try this ISE admin CLI command "tech netstat | inc <ISE-Gi0-IP-Address>:443" to check any ESTABLISHED, TIME_WAIT, or CLOSE_WAIT. If that looks ok, then do other checks, such as telnet on port 443 from another system on the same subnet, and do some packet captures.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
06-29-2019
09:35 PM
06-29-2019
09:35 PM
See the session presentation slide 306 of Advanced ISE – Architect, Design and Scale ISE for your production networks - BRKSEC-3432.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
06-29-2019
09:03 PM
06-29-2019
09:03 PM
CSCvk29208 is an existing issue, but marked un-reproducible.
On ISE 2.4 FCS, I am able to see this issue easily. On ISE 2.4 Patch 8, the new name is showing up once refreshed. So, I would suggest to either try the latest patch, or work around it by deleting the security groups and recreating them with the new names.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
06-29-2019
08:10 PM
06-29-2019
08:10 PM
The current behavior is that the account updates to PSN2 will take over the sessions for the endpoints in M&T session directory.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
06-24-2019
03:46 PM
06-24-2019
03:46 PM
Two things to check:
If only ISE 2.4 Patch 8 with this issue, then you could be hitting CSCvp75207
As your cert chain has AddTrust, it could be cross-signed and might have some compatibility issues for some use cases.
Additionally, you mentioned "... I validate the cert and it's referencing the ISE box itself as if it's attempting to go against the cert I have appended to the admin login vs the portal login. ..." If your deployment has a different certificate for ISE admin portals from that for ISE guest portals, it would be good to either perform a packet capture and verify that the address and port requested and the certificate chain sent from ISE to the clients.
If the above not helping at all, I would suggest you to check with Android support forum. Or, open a case with Cisco support and provide other detailed info, such as specific Android device makes and models and Android OS versions, in order to troubleshoot further.
... View more
Created by
hslai
in Identity Services Engine (ISE)
yesterday
yesterday
Is Identity Caching replicated between PSNs? I presume not but want to
clarify. Correct. This is not...
Tuesday
It might depend on the IOS-XE release or platform or ISE release. Also
check the filter-list used fo...
Tuesday
On 1, the total endpoint count is that in the context visibility and
should be the same as the total...
Tuesday
If this is the only WLC you have, then most likely the response from ISE
is not what it expected. If...
Created by
hslai
in Identity Services Engine (ISE)
Tuesday
Tuesday
You may also try chaining DOT1X machine auth with Easy Connect.
Monday
Try checking the system log events around the time of export by using
ISE admin CLI command "show lo...
Monday
T+ authentication and authorization are two separate events. We should
see something like below: If ...
Monday
On your second inquiry, please see Required Permissions when AD User not
in Domain Admin Group Regar...
Monday
Great. You are getting closer. If Alcatel phones not providing CDP/LLDP
attributes to id them as pho...
Monday
Nope, as you already found. All ISE nodes need to able to communicate
using their real IP addresses.
Monday
Think I've just noticed a bug. According to ERS docs, when BULK request
is successfully accepted, it...
Monday
How does ISE pick which PSN does the WMI probing to which DCs? Only one
PSN is elected as active for...
Monday
AFAIK IBNS 2 is not sending the device-sensor data via RADIUS accounting
interim updates unless the ...
Public Statistics
| Date Registered | 12-03-2009 07:31 AM |
| Date Last Visited | |
| Total Messages Posted | 3,222 |
| Total Helpful Votes Received | 1439 |
Helpful Votes Given To
.jpg "VIP Engager"){kind=icon}
Helpful Votes From
