This looks the same as your other post Re: IBNS 2.0 no-match result-type metho... ... View more

Please use ISE LiveLogs and RADIUS detail reports to verify it matching a new authorization policy rule, sending an authorization profile, either without DACL or with a DACL of more permissions. See also RADIUS MAC authentication host-mode mul... ... View more

In case of LAN Lite, it supports very limited features for ISE and TrustSec. Older IOS trains might have issues, such as CSCtz92782 and CSCtz92782. Also, check whether IP device tracking are working for all the endpoints from the other switch. NB: End-of-Sale and End-of-Life Announcement for the Cisco Catalyst 2960-S Series and 2960-SF Series Switches shows the platform has reached the end-of-sale and the end of SW maintenance; the last date of support is Nov-30, 2020. ... View more

See Configuring AAA Server Groups NB: End-of-Sale and End-of-Life Announcement for the Cisco 3800 Series Integrated Services Routers shows Cisco 3825 (part of Cisco 3800 series ISR) has reached the last date of support in 2016. ... View more

No expert on profiling but I found this CiscoLive session useful -- Cisco Medical Device Segmentation - BRKSEC-2039 -- and may address some of your questions. NB:- http://cs.co/medical-nac links to the main portal on Cisco Medical NAC. ... View more

This could be due to file permissions. I would suggest you to try another FTP client and ensure all files are visible. Other than that, please engage Cisco TAC support. ... View more

As you mentioned "especially in peak hours", so it's likely due to load. In case you have come across it, you might want to start with What's new in ISE Active Directory connector - BRKSEC-2132 Slides 97 and 98 of the reference presentation from Advanced ISE Services, Tips and Tricks - BRKSEC-3697 give advice on auth policy optimization. ... View more

ISE live logs might not have IP addresses of the authentication clients, unless the addresses are known during authentication and the network devices sending them over via the Framed-IP-Address attribute. If the network devices update the IP addresses via RADIUS accounting updates, then the IP addresses will show in the live sessions view or the session entries in the live logs view. ... View more

I've not tried this myself, but it seems depending on this configuration command ip ssh server algorithm authentication at Configuring Digital Certificates for User Authentication  Step 3 ip ssh server algorithm authentication { publickey | keyboard | password } Example: Switch(config)# ip ssh server algorithm authentication publickey Defines the order of user authentication algorithms. Only the configured algorithm is negotiated with the Secure Shell (SSH) client. Note  The IOS SSH server must have at least one configured user authentication algorithm. To use the certificate method for user authentication, the publickey keyword must be configured.     ... View more

The error indicated that it unable to locate the user in the identity store(s). ... View more

None other than asking for an enhancement. ... View more

If you have a copy of the old-style configuration in flash, then you may try copy flash:<old-style-configuration-filename> start reload ... View more