I would suggest you to seek support from Brocade, as the issue you are seeing is specific to Brocade and might be specific to the particular device platform. ... View more

I would suggest to verify the user credentials using the "Test User" tool. Unless the AD infrastructure is locked down or the computer account is pre-created in AD, it does not require a domain admin to join. See Who can add workstation to the domain ... View more

What you said are both correct. ... View more

Try Posture Compound Posture Conditions, then. ... View more

UDID vs UUID vs GUID says, UUID: It is the acronym of Universally Unique Identifier. A sequence of 128 bits that can guarantee uniqueness across space and time, defined by RFC 4122. GUID: It is the acronym of Globally Unique Identifier It is Microsoft's implementation of the UUID specification; often used interchangeably with UUID. In dot net framework its called as Plain GUID and in sql server its called as newid UDID: It is the acronym of Unique Device Identifier It is sequence of 40 hexadecimal characters that uniquely identify an iOS device AFAIK AnyConnect generates its own UDID so that is different from UUID from the output of "wmic csproduct get uuid". The reason ISE uses UDID to query MDM for Apple iOS or Android devices is "AnyConnect does not have permission to access MAC addresses on iOS/Android these days (OS restrictions)," Later so on the UDID and relies on MDM profiles (see MDM Configuration of Device Identifier for AnyConnect on iOS and Android) ... View more

In the "Task Attribute View", pick Generic as the  Common Task Type. Then, go to the "Raw View" and put in the info. ... View more

See Portal Settings for Sponsor Portals Fully Qualified Domain Name (FQDN) —Enter at least one unique FQDN and/or hostname for your Sponsor or MyDevices portal. For example, you can enter sponsorportal.yourcompany.com,sponsor , so that when the user enters either of those into a browser, the sponsor portal displays. Separate names with commas, but do not include spaces between entries. If you change the default FQDN, then also do the following: Update your DNS so that the FQDN of the new URL resolves to a valid Policy Services Node (PSN) IP address. Optionally, this address could point to a load balancer virtual IP address that serves a pool of PSNs. To avoid certificate warning messages due to name mismatches, include the FQDN of the customized URL, or a wildcard, in the subject alternative name (SAN) attribute of the local server certificate of the Cisco ISE PSN. For example, if we use "iseportalurl.abc.edu.sg", which has to be unique and not used elsewhere and configured in DNS to alias to the PSN serving the portal or the load balancer VIP, then going to http://iseportalurl.abc.edu.sg/ will redirect by ISE to the particular sponsor portal. ... View more

From my read of BIG-IP Modules DATASHEET, ASM seems functioning as firewalls. I have not heard anyone using it with ISE. ... View more

Why not use the pre-built conditions? ANY_am_mac_def Any AM definition check on Mac ANY_am_mac_inst Any AM installation check on Mac ANY_am_win_def Any AM definition check on Windows ANY_am_win_inst Any AM installation check on Windows     However, some of them might not have automatic remediations.       ... View more

As this specific IOS-XE 16.x and likely specific Catalyst 9400-series, I moved this thread to Switching. IP Device Tracking New CLI - SISF - Denali 16.3.5 might be of interest to you. ... View more

As you mention it out-of-scope, best to leave it. Wired switches do not send VLAN info by default and IP addresses are not always sent or current in the RADIUS authentication requests. Later, you may consider VLAN RADIUS Attributes in Access Requests.   ... View more