I have 2 stacks of 3850s running 3.6.8E, they were 3.6.6E.  all of our 802.1x clients are failing in ISE.  Our MAB devices are authenticating in ISE  We have other 3.6.8E switches that are authenticating just fine 802.1x and MAB on the same network.  I can move a device that is failing to a different switch and it authenticates just fine.   Interface MAC Address Method Domain Status Fg Session ID Gi4/0/24 00ca.e540.3b1d N/A UNKNOWN Unauth 0A00011E00001273003E36F4 Gi2/0/44 ecb1.d737.a01c N/A DATA Unauth 0A00011E0000121C003E0F08 Gi2/0/48 5065.f344.56b7 N/A DATA Unauth 0A00011E00001281003E5792 Gi4/0/17 a08c.fdc9.7a36 N/A DATA Unauth 0A00011E00001206003E0C42     policy-map type control subscriber ISE-PMAP-522 event session-started match-all 10 class always do-until-failure 10 authenticate using dot1x retries 2 retry-time 0 priority 10 event authentication-failure match-first 10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure 10 activate service-template CRITICAL_AUTH_VLAN_522 20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE 30 authorize 40 pause reauthentication 50 clear-authenticated-data-hosts-on-port 20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure 10 pause reauthentication 20 authorize 30 class DOT1X_NO_RESP do-until-failure 10 terminate dot1x 20 authenticate using mab priority 20 40 class MAB_FAILED do-until-failure 10 terminate mab 20 authentication-restart 60 50 class DOT1X_FAILED do-until-failure 10 terminate dot1x 20 authenticate using mab priority 20 60 class always do-until-failure 10 terminate dot1x 20 terminate mab 30 authentication-restart 60 event agent-found match-all 10 class always do-until-failure 10 terminate mab 20 authenticate using dot1x retries 2 retry-time 0 priority 10 event aaa-available match-all 10 class IN_CRITICAL_VLAN do-until-failure 10 clear-session 20 class NOT_IN_CRITICAL_VLAN do-until-failure 10 resume reauthentication event violation match-all 10 class always do-until-failure 10 restrict     interface GigabitEthernet2/0/22 switchport access vlan 3216 switchport mode access switchport voice vlan 2123 authentication periodic authentication timer reauthenticate server access-session port-control auto mab dot1x pae authenticator dot1x timeout tx-period 10 no cdp enable spanning-tree portfast service-policy type control subscriber ISE-PMAP-3216     We have Cisco IP phones with certs along with PC with Certs. We are using new style and I have compared all the aaa settings and policy maps.  I am starting to draw blanks on what to look at next.   Any help would be insightful. ... View more

I have a handful of users in the same Active Directory group that has disconnect and reconnect issues.  They will connect then anyconnect will disconnect and reconnect them, usually 3 times in a row before it settles down.  This issue has not been reported among the 400 or so other users.  I am posting a picture of the users anyconnect history.   We are using Anyconnect 4.6.01103, on the log from the ASA I do not see this disconnect or reconnect.   ... View more

We had a few users complain about disconnects and reconnects.  We have on average about 500 people who connect to the anyconnect on our ASA 5555.   While looking for a reason we discovered that the Outside interface has some errors and overruns on it.  We do not have flow control turned on.  Could this be a reason why we might have a few users showing disconnects and reconnects?     Interface GigabitEthernet0/0 "", is up, line protocol is up Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps) Input flow control is unsupported, output flow control is off Description: External Client Data Active member of Port-channel1 MAC address cc46.d6f8.4c39, MTU 1500 IP address unassigned 305036353232 packets input, 200800159375818 bytes, 0 no buffer Received 540722 broadcasts, 0 runts, 0 giants 38028648 input errors, 1 CRC, 0 frame, 38028647 overrun, 0 ignored, 0 abort 0 pause input, 0 resume input 0 L2 decode drops 146520215511 packets output, 99195296755085 bytes, 0 underruns 0 pause output, 0 resume output 0 output errors, 0 collisions, 0 interface resets 0 late collisions, 0 deferred 0 input reset drops, 0 output reset drops input queue (blocks free curr/low): hardware (491/321) output queue (blocks free curr/low): hardware (511/0) ... View more

I have users that connect with anyconnect and then use IBM iBase to connect to a database.  When the users connect to anyconnect and then to iBase the users are disconnected from anyconnect and then they reconnect.  This disconnects and reconnects happen 3 times.  Then anyconnect seems to settle down.  We have multiple users that do not use iBase that do not have this issue.  So far this seems to be isolated to just the users that use iBase.  We are using anyconnect 4.6.01103.  I am not sure about the iBase software, I am still waiting on a reply with their version of the software they are using. ... View more

We are testing out using machine certs to authenticate anyconnect VPNs, Does anyone have templates for the asa and pc certificates?  And maybe some best practices for setting up the connection profile? ... View more

I am trying to setup VPN for multi-domain PCs only.  I have a cert on an ASA that allows our main domain computers to connect to the VPN.  We are also installing a root CA and issuing certs to computers of other domains.  I am new to setting up this type of authentication.  I am unable to get the other domain computers to connect.  Do they all have to be part of the same domain?  This is for a government agency and it will be some time before we are all one domain. ... View more

I have a  CIVS-IPC-7070 running 2.7.0.  When I log into with IE and have the video set to H.264 with Active X all I can see is a blank screen.  I change the video to MJPEG and I am able to see video.  I am using a Wndows 10 with IE.  I turned on Active X in Internet options.  I have not been able to figure out what I am missing.   ... View more

I would like to rewrite an identity mac address to parse out the - from xx-xx-xx-xx-xx-xx to a xxxxxxxxxxxx.  I am trying to use what an agency already built in AD to store MAC addresses instead of rebuilding and importing thousands of mac address. ... View more

We are running anyconnect 4.2.04039 on some vehicles and when they hit poor cellular reception the anyconnect disconnects.  I understand that part no network connectivity equals no vpn connection.  What is being complained about is during the disconnect the PC (windows machine) tends to freeze up or stall.  I have been looking into this, does anyone know if a disconnect from cellular or wifi that would cause the anyconnect client to disconnect, could this cause the PC to freeze momentarily? ... View more

I am looking for a way to track mac addresses through something like netdb.  I have tested out netdb on Linux and that works fine.  But what I would like to do is generate a report of devices that have a failed authentication session either mab or 802.1x, then a couple of reports of last seen a month ago and 2 months ago.  I would like to have the port and switch in the reports.  ... View more

Hello all, So I followed the guide https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/210521-Configure-ISE-2-2-for-integration-with-M.html for setting up MySQL and connecting it to ISE.  That connection part works fine.  MySQL is working fine.  The guide shows setting up a users group then a table for groups and mapping users to those groups.  I understand that part.  What I am looking for is a very simple setup.  I what to set up one group that stores mac address that we can use mac address bypass.  The MAB will be for devices that we can't put certs on like printers and other peripheral devices.     Does anyone have a MySQL database design for mac address bypass that would be willing to share?   ... View more