Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Glnc66inc
Stats
Member since
09-16-2009
15
Posts
10
Helpful
0
Solutions
03-01-2013
11:03 AM
cisco ise 1.1.2 and a 3750x (Version 12.2(58)SE2) We have the fix for this... We had to downgrade to 12.2.(55)se7 on the 3750 and allow radius attribute 25 on the switch config. .. radius-server attribute 25 access-request include .. CoA is now functioning properly...
... View more
Created by
Glnc66inc
in Policy and Access
in Policy and Access
03-01-2013
10:59 AM
03-01-2013
10:59 AM
As requested... http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fet chBugDetails&bugId= CSCuc22732 MAB works from a cisco switch because the cisco switch places the mac address in the calling-station-attribute and the user-name attribute. The Cisco ISE platform is looking at the calling-station attribute to find the user name.This is the problem. The radius RFC says the user name must be in the user-name attribute. The calling-station-attribute is not a required field and is used for the phone number of a voip phone. Basically, the ISE platform is looking at the wrong field for the mac address.
... View more
02-28-2013
12:42 PM
We are having an issue using the cisco ise 1.1.2 and a 3750x (Version 12.2(58)SE2) When the radius sends a reauthentication CoA message to the switch, the switch responds with a 'session contect not found' reply. I have upgraded the code to the latest levels on both the ise and switch and still have the same resultts. This reauthenticate is needed after the NAC profiler determines the pc is complient. I am receiving the complient message from the pc and switch, but becuase the switch never reauthentices the client after the CoA request, the client is never granted full access. I am not sure if the radius server is sending the wrong session id, or if the switch is looking at it wrong. Please Help...!!!!! -Debug -- Log Buffer (10000 bytes): Feb 28 19:34:21.940 UTC: RADIUS: COA received from id 38 10.122.1.82:40171, CoA Request, len 140 Feb 28 19:34:21.940 UTC: COA: 10.122.1.82 request queued Feb 28 19:34:21.940 UTC: RADIUS: authenticator 62 6B 15 C9 C7 A5 CA 88 - 4F B2 EE 4C A0 3D 9F 50 Feb 28 19:34:21.948 UTC: RADIUS: NAS-IP-Address [4] 6 10.122.1.66 Feb 28 19:34:21.948 UTC: RADIUS: Event-Timestamp [55] 6 1362080061 Feb 28 19:34:21.948 UTC: RADIUS: Message-Authenticato[80] 18 Feb 28 19:34:21.948 UTC: RADIUS: BC B3 BA 2A 11 BD 63 0B 22 7E 82 AA C2 A5 F7 C4 [ *c"~] Feb 28 19:34:21.948 UTC: RADIUS: Vendor, Cisco [26] 41 Feb 28 19:34:21.948 UTC: RADIUS: Cisco AVpair [1] 35 "subscriber:command=reauthenticate" Feb 28 19:34:21.948 UTC: RADIUS: Vendor, Cisco [26] 49 Feb 28 19:34:21.948 UTC: RADIUS: Cisco AVpair [1] 43 "audit-session-id=0A7A014200000272048AF0F1" Feb 28 19:34:21.948 UTC: COA: Message Authenticator decode passed Feb 28 19:34:21.948 UTC: ++++++ CoA Attribute List ++++++ Feb 28 19:34:21.948 UTC: 07353140 0 00000001 nas-ip-address(585) 4 10.122.1.66 Feb 28 19:34:21.948 UTC: 0735375C 0 00000001 Event-Timestamp(430) 4 1362080061(512FB13D) Feb 28 19:34:21.948 UTC: 0735376C 0 00000009 audit-session-id(794) 24 0A7A014200000272048AF0F1 Feb 28 19:34:21.948 UTC: 0735377C 0 00000009 ssg-command-code(475) 1 32 Feb 28 19:34:21.948 UTC: Feb 28 19:34:21.957 UTC: AUTH-EVENT: auth_mgr_ch_search_record - Search record in IDC db failed Feb 28 19:34:21.957 UTC: RADIUS/ENCODE(00000000):Orig. component type = Invalid Feb 28 19:34:21.957 UTC: RADIUS(00000000): sending Feb 28 19:34:21.957 UTC: RADIUS(00000000): Send CoA Nack Response to 10.122.1.82:40171 id 38, len 62 Feb 28 19:34:21.957 UTC: RADIUS: authenticator DF 18 2F 59 21 4F 84 E1 - 61 B8 43 B8 01 C5 58 B4 Feb 28 19:34:21.957 UTC: RADIUS: Reply-Message [18] 18 Feb 28 19:34:21.957 UTC: RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] Feb 28 19:34:21.957 UTC: RADIUS: Dynamic-Author-Error[101] 6 Session Context Not Found [503] Feb 28 19:34:21.957 UTC: RADIUS: Message-Authenticato[80] 18 Feb 28 19:34:21.957 UTC: RADIUS: 30 C9 AE 52 80 2E A2 54 FF F3 4B C7 28 31 A9 61 [ 0R.TK(1a] ESWHQFL02-S# ESWHQFL02-S# -- Switch Config - aaa authentication login default group tacacs+ local-case aaa authentication login local_login local aaa authentication enable default group tacacs+ enable aaa authentication dot1x default group radius aaa authorization exec default group tacacs+ local aaa authorization commands 5 default group tacacs+ local aaa authorization commands 15 default group tacacs+ local aaa authorization network default group radius aaa authorization network auth-list group DOT1X aaa accounting dot1x default start-stop group radius aaa accounting exec default start-stop group tacacs+ aaa accounting commands 5 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ ! aaa server radius dynamic-author client 10.122.1.82 server-key 7 14141B180F0B client 10.122.1.80 server-key 7 045802150C2E ! aaa session-id common radius-server attribute 6 on-for-login-auth radius-server attribute 6 support-multiple radius-server attribute 8 include-in-access-req radius-server host 10.122.1.82 auth-port 1812 acct-port 1813 key 7 13061E010803 radius-server host 10.122.1.80 auth-port 1812 acct-port 1813 key 7 104D000A0618 radius-server deadtime 5 radius-server key 7 030752180500 radius-server vsa send accounting radius-server vsa send authentication
... View more
Labels:
Created by
Glnc66inc
in Policy and Access
in Policy and Access
02-28-2013
12:32 PM
02-28-2013
12:32 PM
The problem is with the ISE platform. As it turns out, Cisco is not using the correct radius attribute (as stated in the radius RFC).They are using a cisco attribute that other vendors are not using. This bug will be fixed in the 2.x release this spring.
... View more
Created by
Glnc66inc
in Policy and Access
in Policy and Access
08-22-2012
12:46 PM
08-22-2012
12:46 PM
Currently using Cisco ISE 1.1 to authentication both dot1x and mab from Cisco switches. Both features are authenticating properly. When we use a Nortel/Avaya switch for the authenticator, we are unable to authenticate using mac bypass (non-eap (or neap) in Avaya talk..). The correct authentication policy is found in the ISE, but the mac address is not found in the database. We know it is there because the same mac is authenticating with the Cisco switch. Dot1x authenticates properly from both the Cisco and Avaya authenticators. Could this be an issues with the username/password format in the Radius packet from the Cisco? Thanks in advance for any assistance. -Kurt
... View more
Labels:
Created by
Glnc66inc
in Wireless Security and Network Management
in Wireless Security and Network Management
10-28-2009
05:17 PM
10-28-2009
05:17 PM
Thanks for the reply. These users are not 'guest' users. This ssid / vlan is used for a wireless hotspot. Users do not have to register but they would like to limit them to 3 hours or wifi.
... View more
Created by
Glnc66inc
in Wireless Security and Network Management
in Wireless Security and Network Management
10-28-2009
01:17 PM
10-28-2009
01:17 PM
Is it possible to limit the association time for one user/mac address over a 24 hour period? Client has a hot-spot and wants to make sure it is not abused. Current system: wlc 4402, 5.2.193.0 Thanks in advance for the help.
... View more
Re: Multiple redirect URLs for mutliple...
in Wireless and Mobility
10-08-2009
07:54 PM
10-08-2009
07:54 PM
Maybe this can be done with having a unique login success page for each wlan. I am not sure but it is worth looking into. -Kurt
... View more
10-08-2009
07:45 PM
I suggest one vlan for each SSID within a building. The only time I have multiple vlans for the same ssid is when the ap's/users are in another city/building. As somebody already mentioned there will be bleeding of RF between the floors and you can use this to your advantage. The clients app's will not like changing ip's whenever a wifi client roams. There is no reason to complicate things. I hope this helps. -Kurt
... View more
Created by
Glnc66inc
in Wireless and Mobility
in Wireless and Mobility
10-08-2009
07:30 PM
10-08-2009
07:30 PM
Thanks for all the help. I was able to figure it out with all the examples given. I am able to force the users (using javasctipt) to enter an email address with a valid syntax.. (email@somedomein.something). I know this is not forcing users to enter a valid email address, but then that goes against the policy I setup in our terms and conditions for this hotspot. They can use it all they want, but maybe it will remove some liability for my customer if there is a legal issue down the road. I do generate reports for this SSID using the WCS. I think this is enough to protect my customer. Thanks again for all the help. -Kurt
... View more
Created by
Glnc66inc
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
10-01-2009
07:43 AM
10-01-2009
07:43 AM
I think this is more of a security issue. I like to restrict my wireless users with a firewall just incase there are issues. I would not want somebody to hack into my wireless network and have local access to my wired data network/users. If there is not a firewall at least there is another hop between the wireless and wired users. I am not sure about the broadcast issues but I still will not recommend the 'one vlan' solution.
... View more
Created by
Glnc66inc
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
10-01-2009
07:35 AM
10-01-2009
07:35 AM
Make sure the version of WCS supports the IOS version of your WLC4402's. I had this issue when I first installed a WCS platform. You may need to upgrade the WCS.
... View more
Created by
Glnc66inc
in Wireless and Mobility
in Wireless and Mobility
10-01-2009
06:54 AM
10-01-2009
06:54 AM
I am using a 4400 running 5.2.193. I have uploaded a custom webauth bundle, but that does not change the email input page. It is strange. Maybe I am missing something. Also, when I select the custom login page it appears the email input required is ignored. I never see it, only the custom login.html page loaded.
... View more
Created by
Glnc66inc
in Wireless and Mobility
in Wireless and Mobility
09-30-2009
03:58 PM
09-30-2009
03:58 PM
Is it possible to use a custom login.html page when web auth/passthrough is used with email input? I have a requirement to only have the users register with an email address and I need to provide a custom page. I get the custom login pages, but I can not figure out how to make a custom login.html page with only email input. Any help is appreciated. Thanks, Kurt
... View more
Labels:
Created by
Glnc66inc
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
09-16-2009
11:10 AM
09-16-2009
11:10 AM
I am tring to create a custom splash page for a hot spot using AP1522's / WLC4402. Code level is 4.1.192.35(m)-MESH. I have used Web-Passthrough with email input. This is fine for me but I would like to customize the email input page. Maybe there is a better way to do this. Thanks in advance for your suggestions. -Kurt
... View more
03-01-2013
cisco ise 1.1.2 and a 3750x (Version 12.2(58)SE2)We have the fix for
this... We had to downgrade to ...
Created by
Glnc66inc
in Policy and Access
03-01-2013
03-01-2013
As
requested...http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDeta...
02-28-2013
We are having an issue using the cisco ise 1.1.2 and a 3750x (Version
12.2(58)SE2)When the radius se...
Created by
Glnc66inc
in Policy and Access
02-28-2013
02-28-2013
The problem is with the ISE platform. As it turns out, Cisco is not
using the correct radius attribu...
Created by
Glnc66inc
in Policy and Access
08-22-2012
08-22-2012
Currently using Cisco ISE 1.1 to authentication both dot1x and mab from
Cisco switches. Both feature...
Created by
Glnc66inc
in Wireless Security and Network Management
10-28-2009
10-28-2009
Thanks for the reply.These users are not 'guest' users. This ssid / vlan
is used for a wireless hots...
10-28-2009
Is it possible to limit the association time for one user/mac address
over a 24 hour period? Client ...
Created by
Glnc66inc
in Wireless and Mobility
10-08-2009
10-08-2009
Maybe this can be done with having a unique login success page for each
wlan. I am not sure but it i...
10-08-2009
I suggest one vlan for each SSID within a building. The only time I have
multiple vlans for the same...
10-08-2009
Thanks for all the help. I was able to figure it out with all the
examples given.I am able to force ...
Created by
Glnc66inc
in Other Wireless - Mobility Subjects
10-01-2009
10-01-2009
I think this is more of a security issue. I like to restrict my wireless
users with a firewall just ...
10-01-2009
Make sure the version of WCS supports the IOS version of your WLC4402's.
I had this issue when I fir...
10-01-2009
I am using a 4400 running 5.2.193. I have uploaded a custom webauth
bundle, but that does not change...
09-30-2009
Is it possible to use a custom login.html page when web auth/passthrough
is used with email input? I...
Created by
Glnc66inc
in Other Wireless - Mobility Subjects
09-16-2009
09-16-2009
I am tring to create a custom splash page for a hot spot using AP1522's
/ WLC4402. Code level is 4.1...
Public Statistics
| Date Registered | 09-16-2009 10:55 AM |
| Date Last Visited | 08-18-2017 03:54 AM |
| Total Messages Posted | 15 |
| Total Helpful Votes Received | 10 |
