Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Kamran Barlas
08-15-2019
Stats
Member since
07-31-2012
11
Posts
5
Helpful
1
Solution
03-10-2014
08:12 AM
Cheers, wans't sure if in HA mode if the DHCP Proxy setting is disabled globally and unselected (i think this customer is firmware 7.4.100
... View more
Created by
Kamran Barlas
in Wireless and Mobility
in Wireless and Mobility
03-10-2014
07:41 AM
03-10-2014
07:41 AM
DHCP Proxy is required in order to use local WLC DHCP Pool (Guest Anchor), however reading Wireless Q&A (http://www.cisco.com/image/gif/paws/107458/wga-faq.pdf) states that both foreign and guest anchors must have : In a Wireless guest access setup, the DHCP proxy setting in the Guest Anchor controllers and the internal controller must match. Else, DHCP request from clients are dropped and you see this error message on the internal controller...... However if you have N+1 you cannot use internal DHCP, does this also "grey" out the DHCP Proxy global setting? If so will the Guest Anchor still work with a internal DHCP pool even though foreign and guest controllers have a mismatch in DHCP Proxy (global) setting? Many Thanks Kam
... View more
Labels:
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
01-17-2013
10:14 AM
01-17-2013
10:14 AM
Update2: Cisco have filled a new bug / feature enhancement request: After discussions with developers, I Have filled a new bug: CSCue08551 - ISE Native Supplicant Provisioning doesn't include CA Cert for EAP TLS Symptom: ISE Client Provisioning (NSP) installs only the HTTPS Certificate which cause EAP-TLS authentication to fail. Conditions: EAP and HTTPS Functions on ISE use a different certificate Workaround: Use same certificate for HTTPS and EAP. This will be treated as an enhancement, as the HTTPs needs to be included since it’s always used to establish the connection between the Wizard and ISE for SCEP Requests. Also, different ISE Policy nodes might have a certificate signed by a different CA. The fix would be to have an option on the NSP Profile to push additional CA Certificates. Hope this helps someone Cheers Kam
... View more
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
01-10-2013
01:40 PM
01-10-2013
01:40 PM
Update: Cisco TAC can also replicate this issue in their lab, they have escalated to developers to confirm bug Meanwhile I'm using peap mschapv2 with the public certificate
... View more
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
01-09-2013
12:29 PM
01-09-2013
12:29 PM
onboarding with PEAP works but again the Public Certificate Root CA is delivered to the "onboarding/provisioning" device rather than the local CA (which has EAP "enabled"), and as PEAP only needs server side Cert to work, this works (providing the "trust for TLS" is ticked on Public ROOT Cert) ideally i would love the EAP-TLS solution as this near enough provides a zero-touch solution for the clients, but needs to work via the provisioning methods else its unmanageble for BYOD devices, if you use local CA certificate your guests will get a Cert warning, I'm not sure how people have got both onboarding working with both public and local Certs? BTW i have logged a TAC call, lets see what they come back with, will update this thread if i get anything Cheers kam
... View more
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
01-09-2013
08:18 AM
01-09-2013
08:18 AM
the process doesnt fail as such for the onboarding/provisioning on the iphone, however the when entering domain credentials to the guest portal which intiates the onboarding/provisioning process, i notice the root CA certificate is prompted to be installed on the iphone is that of the public certificate instead of the internal root CA, the rest of the user certificate and scep process properly completes however as the root CA for the internal CA wasnt installed i get warnings when connect to our dot1x eap-tls SSID. On other devices this process fails which i can only assume is down to the lack of internal root CA cert so as per the above im pretty much following this (differentiated access via certificates) : http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_60_byod_certificates.pdf however my setup is slighlty different as the EAP & HTTPS indentity certificate is not the internal, i have installed a public cert for HTTPS to remove certificate warnings on guest portal (as BYOD devices and guests will only have non-domain machines thus a public cert removes the certificate warnings) does that clarify anymore? Cheers Kam
... View more
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
01-09-2013
02:29 AM
01-09-2013
02:29 AM
Anyone run into the issues similar to the below?: Public Certificate bound for HTTPS Internal AD Certificate Bound for EAP Issue is SPW or Native Supplicant will be provisioned with Root CA of Public Cert then SCEP enrolls EAP-TLS with Internal CA however as client device (ipad/iphone/android) doesnt get the Internal Root CA provisioned they will fail EAP-TLS communication Running ISE 1.1.2 patch2, 2 node-cluster Guest Portal being used for Provisioning if AD credentials passed Works a treat if i bind both https & eap on the Internal identity ceritficate (only issue then is Guests/BYOD devices get Certificate Warnings on the portal) Cheers Kam
... View more
Labels:
01-09-2013
01:47 AM
Does anyone know the maximum amount of DAP plocies that can be created on a Cisco ASA? (5520 / 8.4) I know the priority ranges are Values of 0 to 2147483647 are valid, but need to know if there is a limit in the number of DAP Polices that ccan be created on a Cisco ASA
... View more
Labels:
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
07-31-2012
09:42 AM
07-31-2012
09:42 AM
Cheers, i thought that was some other device
... View more
Created by
Kamran Barlas
in Policy and Access
in Policy and Access
07-31-2012
08:06 AM
07-31-2012
08:06 AM
Anyone else not seeing the Wireless LAN Controller tick box in Authorization Profile? Clean install of 1.1.1. with ISE Version 1.1.1.268—Cumulative Patch 1 applied EVAL license All the documentation says it should still be there in 1.1.1 unless im missing a trick?
... View more
Labels:
03-10-2014
Cheers, wans't sure if in HA mode if the DHCP Proxy setting is disabled
globally and unselected (i t...
Created by
Kamran Barlas
in Wireless and Mobility
03-10-2014
03-10-2014
DHCP Proxy is required in order to use local WLC DHCP Pool (Guest
Anchor), however reading Wireless ...
Created by
Kamran Barlas
in Policy and Access
01-17-2013
01-17-2013
Update2: Cisco have filled a new bug / feature enhancement request:After
discussions with developers...
Created by
Kamran Barlas
in Policy and Access
01-10-2013
01-10-2013
Update: Cisco TAC can also replicate this issue in their lab, they have
escalated to developers to c...
Created by
Kamran Barlas
in Policy and Access
01-09-2013
01-09-2013
onboarding with PEAP works but again the Public Certificate Root CA is
delivered to the "onboarding/...
Created by
Kamran Barlas
in Policy and Access
01-09-2013
01-09-2013
the process doesnt fail as such for the onboarding/provisioning on the
iphone, however the when ente...
Created by
Kamran Barlas
in Policy and Access
01-09-2013
01-09-2013
Anyone run into the issues similar to the below?:Public Certificate
bound for HTTPSInternal AD Certi...
01-09-2013
Does anyone know the maximum amount of DAP plocies that can be created
on a Cisco ASA? (5520 / 8.4)I...
Created by
Kamran Barlas
in Policy and Access
07-31-2012
07-31-2012
Cheers, i thought that was some other device
Created by
Kamran Barlas
in Policy and Access
07-31-2012
07-31-2012
Anyone else not seeing the Wireless LAN Controller tick box in
Authorization Profile?Clean install o...
Public Statistics
| Date Registered | 07-31-2012 07:58 AM |
| Date Last Visited | 08-15-2019 11:36 PM |
| Total Messages Posted | 11 |
| Total Helpful Votes Received | 5 |
