Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About hslai
hslai
Member since
12-03-2009
Cisco Employee
02-19-2019
06:18 AM
In configuring an ISE posture requirements, we may have OR the conditions by "Any selected conditions succeeds".
In configuring an ISE posture policy rule, we may flag a requirement as optional.
Here are some examples:
Or Requirements
Mandatory / Optional Requirements
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-17-2019
09:03 AM
02-17-2019
09:03 AM
The menu locations changed over the time across different ISE releases.
... View more
02-17-2019
08:54 AM
I would suggest you to try authentication locally and passing only the authorizations to T+ server(s).
https://www.pragmasys.com/products/support/cisco-2-factor is similar to your ask, although PragmaSys's solution is geared to be more secured than for automation convenience.
... View more
02-17-2019
08:47 AM
Potentially yes but not recommended as it may contribute to delays in ISE auth processes.
PS: Please start your own thread and reference an existing one instead of posting to a thread that dormant for months and already answered.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-17-2019
08:39 AM
02-17-2019
08:39 AM
IT-Servicedesk, Thanks for contributing.
Even though I am not in the Cisco IOS platform team, I've seen "%DOT1X-5-RESULT_OVERRIDE" often enough. It means that it not meeting the local configuration. You found one of the triggers. The ones I often encountering are that the ACL name (e.g. REDIRECT ACL) not matching any defined on the switch configuration or the VLAN passed down from ISE is not defined.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
07:34 PM
02-16-2019
07:34 PM
Please share your TAC case number so I may communicate it with our product teams. Else, How to Submit an ISE Feature or Enhancement Request
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
04:09 PM
02-16-2019
04:09 PM
IEEE 802.1x inaccessible authentication bypass appears needing a minimal IOS release of 12.2(25)SED or 12.2(25)SEE, per Release Notes for the Catalyst 3750, 3560, 2960-S, and 2960 Switches, Cisco IOS Release 12.2(58)SE1 and Later
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
03:27 PM
02-16-2019
03:27 PM
That would be great for you to write it up and contribute to this community. I would also suggest to send it in as a feedback to ISE product management team so to consider it as an enhancement.
... View more
02-16-2019
03:19 PM
Since you resolved it by reloading ISE, it's likely some temporary issue with the system resources. If needed, please engage Cisco TAC to troubleshoot when it happens again. I myself have not run into such.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
03:00 PM
02-16-2019
03:00 PM
Start off by reviewing ISE Profiling Design Guide. Check what attributes collected for the IP phone and any matches to the profiler policy rules. Please open a TAC case if you need further help.
PS: Always start your own thread instead of resurrecting one dormant for months, please.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
02:39 PM
02-16-2019
02:39 PM
Also see ISE Install Guide, Release 2.4 > Deployment Size and Scaling Recommendations and also the slides 29 and 32 of the reference slide deck for Designing ISE for Scale & High Availability - BRKSEC-3699
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
02:33 PM
02-16-2019
02:33 PM
I agree with you to resolve DHCP IP assignment is important. You may, however, temporarily use a static IP to check other connectivity issues.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
02:32 PM
02-16-2019
02:32 PM
Configure Anomalous Endpoint Detection and Enforcement on ISE 2.2 > Background Information has the info how it working currently.
If you want to check ISE debug logs, then enable DEBUG on profiler and check profiler.log files.
... View more
Created by
hslai
in Policy and Access
in Policy and Access
02-16-2019
02:16 PM
02-16-2019
02:16 PM
Likely due to CSCvf30591
... View more
02-16-2019
02:13 PM
Check out the newer guide ISE Secure Wired Access Prescriptive Deployment Guide > NEAT with Interface Templates
PS: Please start your own thread and reference the old one(s) but avoid re-surrent a thread inactive for months.
... View more
3 weeks ago
What Mohammed al Baqari said appears correct. It appears Microsoft
Intune using the ISE admin certif...
Created by
hslai
in Identity Services Engine (ISE)
3 weeks ago
3 weeks ago
Jason Kunst is correct that the changing passwords in ISE portals are
not available for external ID ...
Created by
hslai
in Identity Services Engine (ISE)
4 weeks ago
4 weeks ago
For ISE 2.4 and 2.6, we will receive only alarms and notifications when
not enough VM licenses alloc...
Created by
hslai
in Identity Services Engine (ISE)
4 weeks ago
4 weeks ago
Primary PAN is where we import licenses for the deployment. Since ISE
2.4, VM licenses should match ...
Created by
hslai
in Identity Services Engine (ISE)
4 weeks ago
4 weeks ago
Perhaps the SXP connections not permitted. See TrustSec Troubleshooting
Guide Other TrustSec resourc...
4 weeks ago
In configuring an ISE posture requirements, we may have OR the
conditions by "Any selected condition...
Created by
hslai
in Identity Services Engine (ISE)
4 weeks ago
4 weeks ago
When you add the host_key, ensure it matching the host name; e.g.
"crypto host_key add host vs-sftp1...
a month ago
The menu locations changed over the time across different ISE releases.
LITHIUM.OoyalaPlayer.addVide...
a month ago
I would suggest you to try authentication locally and passing only the
authorizations to T+ server(s...
a month ago
Potentially yes but not recommended as it may contribute to delays in
ISE auth processes. PS: Please...
a month ago
IT-Servicedesk, Thanks for contributing. Even though I am not in the
Cisco IOS platform team, I've s...
a month ago
As ISE inherits T+ from ACS, please take a look at this guide --
007-013144-001_SAS_IntegrationGuide...
Created by
hslai
in Policy and Access
a month ago
a month ago
Please share your TAC case number so I may communicate it with our
product teams. Else, How to Submi...
a month ago
IEEE 802.1x inaccessible authentication bypass appears needing a minimal
IOS release of 12.2(25)SED ...
Created by
hslai
in Policy and Access
a month ago
a month ago
That would be great for you to write it up and contribute to this
community. I would also suggest to...
Public Statistics
| Date Registered | 12-03-2009 07:31 AM |
| Date Last Visited | |
| Total Messages Posted | 2,858 |
| Total Helpful Votes Received | 1154 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 62 | |
| 5 | |
| 11 |
.jpg "VIP Collaborator"){kind=icon}
Helpful Votes From
