Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Arne Bier
Arne Bier
.jpg){kind=icon}
VIP Advocate
I have been working in the IT industry since 1996 as a graduate out of university. I have worked for IBM, Cisco Systems, Dimension Data and I am currently working at IPTel Solutions in Brisbane, Australia.
I have held my CCIE #6282 since 2000 and keep re-certifying in whatever my current job requires - currently it's Security.
My professional career has taken me all around the world and exposed me to Enterprise and Service Provider customers. When I am not analysing Wireshark trace files, you might find me riding my mountain bike, or taking a walk, listening to my favourite podcasts.
My main work centers around AAA, particularly with Cisco ISE, Free Radius and Aruba Clearpass. I have some years of experience with Cisco Prime Access Registrar, which is the Service Provider AAA platform. I like to think along vendor neutral lines because if I understand the theory, then I should theoretically be able to apply this to any vendor. But at the end of the day I spend the majority of my time working with Cisco customer environments.
I am currently cross-skilling over to add Wireless LAN to my portfolio (CWNP track).
I have been working in the IT industry since 1996 as a graduate out of university. I have worked for IBM, Cisco Systems, Dimension Data and I am currently working at IPTel Solutions in Brisbane, Australia.
I have held my CCIE #6282 since 2000 and keep re-certifying in whatever my current job requires - currently it's Security.
My professional career has take
Awards
1
Cisco Designated VIPs 2019 ISE
Recent Badges
Stats
Member since
02-23-2017
1340
Posts
1529
Helpful
266
Solutions
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
09-15-2019
07:44 PM
09-15-2019
07:44 PM
Hello
Is there a best practice around handling Cisco FlexConnect APs and their switchport configuration when doing profiling? Flex APs require commands relating to trunking and native VLAN etc. - which is different to the usual port template that I apply when I am authenticating access port devices.
I want all my Cat 9300 ports to have the same config to start off with - e.g. - and only if I AuthZ a FlexAP, I want ISE to send the necessary result to apply a different Port Template
interface FiveGigabitEthernet2/0/48
device-tracking attach-policy IPDT_POLICY
source template PORT-AUTH-TEMPLATE
spanning-tree portfast
On the the Cat 9300 switch (IOS-XE 16.9.4) I have created two port templates - one for access ports, and one for FlexAPs - they both share the same subscriber service policy (802.1X first, then MAB, etc - IBNS 2.0)
template APFLEX-PORT-TEMPLATE
spanning-tree portfast trunk
dot1x pae authenticator
dot1x timeout tx-period 7
dot1x max-reauth-req 3
switchport trunk native vlan 99
switchport mode trunk
mab
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber PORT-AUTH-POLICY
description ** DOT1X FlexAP Trunk **
template PORT-AUTH-TEMPLATE
spanning-tree portfast
dot1x pae authenticator
dot1x timeout tx-period 7
dot1x max-reauth-req 3
switchport access vlan 10
switchport mode access
switchport voice vlan 15
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber PORT-AUTH-POLICY
description ** DOT1X Enabled Port **
When ISE profiles a Cisco AP then it returns an AuthZ Result as follows
It works but is this the correct approach? I noticed that even after the port is shut down, the config remains. It's not dynamic.
And the mixture of access and trunk settings looks messy.
We start off like this
S1#show run int fiveGigabitEthernet 2/0/48
interface FiveGigabitEthernet2/0/48
device-tracking attach-policy IPDT_POLICY
source template PORT-AUTH-TEMPLATE
spanning-tree portfast
When you successfully auth an AP on that port then through the magic of IBNS the config changes slightly (port-template sent via ISE)
S1#show run int fi 2/0/48
interface FiveGigabitEthernet2/0/48
device-tracking attach-policy IPDT_POLICY
source template PORT-AUTH-TEMPLATE
spanning-tree portfast trunk
end
which currently ‘expands‘ to a derived config of:
S1#show derived-config int fi 2/0/48
interface FiveGigabitEthernet2/0/48
description ** DOT1X FlexAP Trunk **
switchport access vlan 10
switchport trunk native vlan 99
switchport mode trunk
switchport voice vlan 15
device-tracking attach-policy IPDT_POLICY
authentication periodic
authentication timer reauthenticate server
access-session closed
access-session port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 7
dot1x max-reauth-req 3
spanning-tree portfast trunk
service-policy type control subscriber PORT-AUTH-POLICY
end
And for sanity check, the AP is in trunk mode
S1#show int fi 2/0/48 switchport
Name: Fi2/0/48
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 10 (VLAN0010)
Trunking Native Mode VLAN: 99 (VLAN099)
Administrative Native VLAN tagging: disabled
Voice VLAN: 15 (VLAN0015)
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Vepa Enabled: false
Appliance trust: none
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-15-2019
05:30 PM
09-15-2019
05:30 PM
Can't say I have ever seen this in the wild. Probably came into most vendors' equipment to ensure a tick in the RFC process.
Future Look: As soon as you start deploying WPA3 you will have this on by default because it is required as part of the WPA3 standard. Not many clients out there that do WPA3 yet - but this requirement will take care of this discussion in future deployments. If you give users/vendors too much choice to make things optional then of course they will take the path of least resistance. WPA3 will usher in a new era :)
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
09-11-2019
09:19 PM
09-11-2019
09:19 PM
Hi @craiglebutt
With wireless you have to be specific about how the devices associate to the WLAN
- PSK - ISE is not involved - basic pre shared key on the device
- iPSK - ISE is involved and this is still PSK on the device, but you can assign a unique PSK on each device, provided ISE has the MAC address of the device in its Identity Group - import them via .csv
- EAP-PEAP - this is what I think you're alluding to - each device has a supplicant that has to be configured to associate to the SSID doing enterprise WPA2 - you can use the same username/password for all 400 devices, but as Damien said, if the account gets locked out then all 400 devices share the same fate. It can work though - just create a service account in AD that can never be locked out - if you are concerned that this AD account will be abused by other devices, then that is a privacy/concern and there is not much you can do other than to keep that password as complex as possible and not tell anyone. Or you can tied some MAC filtering to this. The trick is to add all the MAC addresses into ISE, and then on the WLC, disable the NAC State option (if it says RADIUS/ISE, then change it to None). This will allow you to perform 802.1X and MAB - one after the other. If PEAP auth works, then MAB auth is next - both have to pass in order for the association to succeed.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
09-09-2019
04:12 AM
09-09-2019
04:12 AM
Hi
I am not sure what Accounting and Posture have in common but RADIUS Accounting is always associated with an active Session on the NAS. The NAS will send an Accounting Start when the session starts, and a Stop when the session terminates (e.g. session timeout or session killed by operator). RADIUS Accounting Interim-Updates are sent (if configured) by the NAS at an interval period to inform RADIUS server of the status of the session.
When the RADIUS server sends the CoA to change the session authorization, then it must send the CoA to the NAS that is handling that session. NAS will send a CoA-ACK back. In the case of ISE, the PSN that sends the CoA must also receive the CoA-ACK. If this is not the case, then there is a problem at a fundamental layer (IP routing, or load balancer, firewall, etc.)
When you click on the ISE GUI Context Visibility to change the Session's state (e.g. Re-Auth, or Port Bounce) then ISE does something funky under the hood and the CoA is sent by the MnT to the PSN or something along those lines - I never understood why, but in the end, the NAS receives that CoA from the PSN's source IP address. The NAS must send the ACK to that same PSN. When PSN receives that ACK then it knows the CoA was successful.
Run a tcpdump on the PSN to see this in action.
... View more
09-08-2019
02:38 PM
Thanks @Damien Miller - I also started off with Hari's config and then took a few things from your config too. I am astounded that getting device sensor to work is so complicated. On Cisco WLC it's one check box - on/off. Simple. And to add to that, when we drink the cool aid and sell this idea of profiling to our customers who have invested heavily in Cat9K line, we end up with egg on our face. I am building MAB Groups now and shoving all these devices into MAB Groups just to get devices online. I wonder how others are managing to profile their devices? DHCP sent to PSN directly? SNMP polling? It still confuses me a bit because we have many different ways of getting profiling data - I don't like the active probing method but it would appear to be a way out of this dilemma.
1st prize - use Device Sensor to gather DHCP/LLDP/CDP/HTTP for "free" - scalable and least amount of hassle for ISE
2nd prize - no Device Sensor - tell ISE to poll SNMP MIB of switch on linkup trap - and configure ip helper to send DHCP to a pair of PSN's - does that effectively achieve the same as Device Sensor? I am not clear on the feature parity of these two methods - and the relative drawbacks of the second method.
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-05-2019
10:43 PM
09-05-2019
10:43 PM
Hi @Scott Gillies
Your timing is perfect. I just unboxed two brand new 5520's and they came shipped from factory with CIMC 4(01)a and WLC code 8.3.140.0
My plan was to put both controllers on the gold star release (8.5.151.0) - the release notes were already confusing because they recommended an older version of CIMC. I suspect the documentation has not been updated. Ignore that old CIMC.
I upgraded both controllers to 8.5.151.0 while it was on the "old" CIMC code.
I then proceeded to upgrade both servers using the HUU (Host Update Utility) to version 4.(02)h
Everything went smoothly.
... View more
09-05-2019
04:10 AM
Hello
Trying to do some device profiling for a wired 802.1X deployment.
No matter what I try, I cannot see Device Sensor data in the RADIUS accounting. Is there a magic command that I have forgotten? It works so easily on Cisco WLC's - but trying to do the same on a Cat 9300 switch requires some special voodoo magic.
I have tried the following IOS-XE releases: 16.9.2 / 16.9.3 / 16.10.1 - rebooted a few times. No joy.
I can see the Device Sensor Data in the cache, but not in the ISE tcpdump RADIUS decode. The RADIUS Accounting Requests are sent by the switch - but they don't contain Device Sensor data. How does one know whether the Device Sensor is correctly configured?
#show device-sensor details
Device-Sensor Details
--------------------------------------
Status = Enabled
Protocols:
-----------
CDP registered Proto Tlv Limit = 128
LLDP registered Proto Tlv Limit = 128
DHCP registered Proto Tlv Limit = 128
Protocol Filter Configuration:
---------------------------------
CDP Include List - cdp-list
LLDP Include List - lldp-list
DHCP Include List - dhcp-list
I am aware that DHCP data is not in the Device Sensor, because DHCP Snooping has not yet been enabled. But I am specifically looking for LLDP and CDP data at the moment.
e.g. a Cisco 4800 AP reports LLDP and CDP - I have truncated the output - it's quite long ...
#show device-sensor cache int fi 2/0/46
Device: 70b3.1747.3c04 on port FiveGigabitEthernet2/0/46
----------------------------------------------------------------------------
Proto Type:Name Len Value Text
LLDP 6:system-description 199 0C C5 43 69 73 63 6F 20 41 ..Cisco A
50 20 53 6F 66 74 77 61 72 P Softwar
65 2C 20 61 70 33 67 33 2D e, ap3g3-
6B 39 77 38 20 56 65 72 73 k9w8 Vers
#show access-session int fi 2/0/46 de
Interface: FiveGigabitEthernet2/0/46
IIF-ID: 0x18B6D438
MAC Address: 70b3.1747.3c04
IPv6 Address: Unknown
IPv4 Address: 10.55.70.40
User-Name: 70-B3-17-47-3C-04
Status: Authorized
Domain: DATA
Oper host mode: multi-auth
Oper control dir: both
Session timeout: N/A
Common Session ID: 1108370A0000002C01144EAC
Acct Session ID: 0x0000000b
Handle: 0x3e000022
Current Policy: PORT-AUTH-POLICY
Local Policies:
Server Policies:
Method status list:
Method State
dot1x Stopped
mab Authc Success
I wonder whether I am running into a bug? The config below is correct as far as I can tell. I can see RADIUS Interim-Updates for the Cisco AP above, but none of the Device Sensor is in there.
Configuring Device Sensor is not trivial - we are told to configure it a certain way and we all follow blindly - nobody wants to over complicate things - we just want to CDP/LLDP/HTTP in the RADIUS please !!!
On Cisco WLC's it's two check-boxes and boom! Done. That's how it should be. Remember "QoS done the hard way in 1999" ? Cisco gave us Auto QoS. We need Auto-Device-Sensor :)
aaa new-model
!
aaa group server radius ISE-GROUP
server name xxxx
server name yyyy
aaa authentication dot1x default group ISE-GROUP
aaa authorization network default group ISE-GROUP
aaa accounting update newinfo periodic 2880
aaa accounting identity default start-stop group ISE-GROUP
!
aaa server radius dynamic-author
client xxxx
client yyyy
aaa session-id common
!
device-sensor filter-list cdp list cdp-list
tlv name device-name
tlv name address-type
tlv name capabilities-type
tlv name version-type
tlv name platform-type
!
device-sensor filter-list lldp list lldp-list
tlv name system-name
tlv name system-description
tlv name system-capabilities
!
device-sensor filter-list dhcp list dhcp-list
option name host-name
option name requested-address
option name parameter-request-list
option name class-identifier
option name client-identifier
device-sensor filter-spec dhcp include list dhcp-list
device-sensor filter-spec lldp include list lldp-list
device-sensor filter-spec cdp include list cdp-list
device-sensor notify all-changes
device-tracking tracking auto-source override
device-tracking tracking retry-interval 60
!
device-tracking policy IPDT_POLICY
security-level glean
no protocol ndp
no protocol udp
tracking enable reachable-lifetime 10
!
authentication critical recovery delay 1000
access-session attributes filter-list list DS_LIST
vlan-id
cdp
lldp
dhcp
http
access-session authentication attributes filter-spec include list DS_LIST
access-session accounting attributes filter-spec include list DS_LIST
access-session monitor
access-session acl default passthrough
dot1x system-auth-control
dot1x critical eapol
lldp run
template PORT-AUTH-TEMPLATE
spanning-tree portfast
dot1x pae authenticator
dot1x timeout tx-period 7
dot1x max-reauth-req 3
switchport access vlan 123
switchport mode access
switchport voice vlan 124
mab
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber PORT-AUTH-POLICY
description ** DOT1X Enabled Port **
interface FiveGigabitEthernet2/0/46
device-tracking attach-policy IPDT_POLICY
source template PORT-AUTH-TEMPLATE
spanning-tree portfast
ip access-list extended CRITICAL_AUTH_ACL
remark ISE down permit all access
permit ip any any
ip access-list extended IPV4_CRITICAL_ACL
permit ip any any
!
!
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server attribute 31 mac format ietf upper-case
radius-server attribute 31 send nas-port-detail mac-only
radius-server dead-criteria time 10 tries 3
radius-server deadtime 15
!
radius server xxxx
address ipv4 xxxx auth-port 1812 acct-port 1813
automate-tester username NAD-Tester ignore-acct-port probe-on
key xxxx
!
radius server yyyy
address ipv4 yyyy auth-port 1812 acct-port 1813
automate-tester username NAD-Tester ignore-acct-port probe-on
key yyyy
!
... View more
- Tags:
- Device Sensor
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-02-2019
03:09 AM
09-02-2019
03:09 AM
Hi @Leo Laohoo
thanks for the positive confirmation. I only have two 5520 controllers to upgrade. I have downloaded the ucs-c220m4-huu-4.0.2h.iso and I will mount it via the vKVM. Luckily I am in a preparation phase and therefore I am not time constrained. My main aim is to NOT brick the brand new appliance ;-)
regards
Arne
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-02-2019
01:48 AM
09-02-2019
01:48 AM
Ok if that’s safe to do then I will do so. If you tried doing that to an ISE server you end up breaking the appliance because of Secure Boot.
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-01-2019
10:38 PM
09-01-2019
10:38 PM
Hello
Brand new 5520 out of the box was shipped with CIMC 4.0(1a)
We intend running 8.5.151.0 on this appliance and the release notes state to install 3.0(4d)
Even the latest 8.9.111.0 say the same thing. No mention of CIMC 4.0 anywhere.
Questions
Is it ok to stay on the 4.0(1a) release or is it mandatory to be on 3.0(4d)?
Can WLC run an even newer version of CIMC (4.0.2h) without breaking the WLC system? Customer is very security conscious and wants to know we have applied latest CIMC if supported.
regards
Arne
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-01-2019
02:45 PM
09-01-2019
02:45 PM
Hi @3d3d4ul3r
Is that 3500 configured identically to the other APs? e.g. is it perhaps in the wrong AP Group? Or does it perhaps have some left over FlexConnect config buried somewhere?
I would try factory defaulting that AP and then starting again. There is nothing in ISE that requires AP-level configuration for a lightweight AP setup like yours.
Have you perhaps inadvertently added the AP as a RADIUS client in ISE? Only the WLC should be a RADIUS client in ISE.
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
09-01-2019
02:38 PM
09-01-2019
02:38 PM
Failing that I find that if you remove the client device from ISE's Device list, then ISE won't respond to the client, and hence, the WLC will fail through to LOCAL again. It works for TACACS too.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
08-28-2019
09:25 PM
08-28-2019
09:25 PM
By default, Windows does not enable EAP on the wired interfaces. You have to enable this under the Windows Services (Wired AutoConfig). Once you have done that, go to the Ethernet adapter and then check the new Security tab that has appeared. Has the supplicant been provisioned?
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
08-27-2019
03:57 PM
08-27-2019
03:57 PM
One VLAN to rule them all!!! Nice ... let's park that discussion. FlexConnect is just an alternative to Central Switching when the controller is central, but APs are spread over various geographic locations - the traffic stays local.
Can you still please explain what this "domain trust issue" is?
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
08-27-2019
03:03 PM
08-27-2019
03:03 PM
Hi @tombstone1
Can you explain a bit more about what the "trust domain relationship issue" is ?
The end result of a wireless association is that the client session is in RUN state and its traffic is fed into a VLAN (for central switching), or in the case of FlexConnect, the traffic breaks out of the AP onto a VLAN on the attached switch. There should be no impact for the upper layers (AD domain or otherwise). If you are plugging users into a switch port then you may not be making a fair comparison, unless you can prove that they ended up on the same VLAN.
... View more
Created by
Arne Bier
in Identity Services Engine (ISE)
09-19-2019
09-19-2019
Hi @klauerma If the NAD devices are not to be touched/changed, then the
VIP concept will work. My on...
Created by
Arne Bier
in Identity Services Engine (ISE)
09-19-2019
09-19-2019
Hi @Mohamed Kabeer S If you have have the ability to join the specific
AD domain and make that a uni...
09-15-2019
Hi @Mats Nilson The Queue Link Error was caused due to a bug
https://bst.cloudapps.cisco.com/bugsear...
Created by
Arne Bier
in Cisco Digital Network Architecture (DNA)
09-15-2019
09-15-2019
Hi @Beacon Bits You can open the debugger in a browser and see all the
client side code. It's javaSc...
09-15-2019
Hi @NiganKhan If you're looking at DNA Center then Cisco has some pretty
good training on https://di...
Created by
Arne Bier
in Policy and Access
09-15-2019
09-15-2019
Hello Is there a best practice around handling Cisco FlexConnect APs and
their switchport configurat...
09-15-2019
Can't say I have ever seen this in the wild. Probably came into most
vendors' equipment to ensure a ...
09-15-2019
Restoring an ISE 2.3 config backup onto a freshly built ISE 2.6 should
present no issues. I have not...
09-12-2019
Hi @Mats Nilson I was about to advise a customer to patch their new ISE
2.6 deployment and looks lik...
Created by
Arne Bier
in Identity Services Engine (ISE)
09-12-2019
09-12-2019
Hi @mnagired I am faced with this dilemma myself. ISE 2.6 (no patch). Is
this bug fixed in patch 1 o...
Created by
Arne Bier
in Policy and Access
09-11-2019
09-11-2019
Hi @craiglebutt With wireless you have to be specific about how the
devices associate to the WLAN - ...
09-11-2019
TC-NAC is a bit of a special beast. I have not done one myself, but
there is a nice write up about g...
Created by
Arne Bier
in Identity Services Engine (ISE)
09-11-2019
09-11-2019
Have you tried toggling the Portal cert ? I think you ought to open a
TAC case.
Created by
Arne Bier
in Identity Services Engine (ISE)
09-11-2019
09-11-2019
Hi @Colby.LeMaire That's a cool summary of why things are the way they
are. I just need to caution h...
Created by
Arne Bier
in Identity Services Engine (ISE)
09-11-2019
09-11-2019
Hi rashish135@yahoo.co.in While you're checking the CA cert chain for
the portal cert, check that th...
Public Statistics
| Date Registered | 02-23-2017 06:57 PM |
| Date Last Visited | 09-19-2019 02:06 AM |
| Total Messages Posted | 1,340 |
| Total Helpful Votes Received | 1529 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 10 | |
| 146 | |
| 31 | |
| 10 |
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 55 | |
| 5 |
Awards
Cisco Designated VIPs
2019 ISE
