About Arne Bier

Arne Bier · 10-03-2024

Hello, Issue - I see these in the Dashboard Alarms and I want to know the cause. The PAN, MNT and PSN are all on the same subnet. ISE 3.3p3 Catalyst switch: IOS-XE17.06.05 (but happens on other versions too) I need some advice with why ISE is report...

Arne Bier · 09-23-2024

Hello DNAC/Cat Center is a very chatty product and it's constantly logging into devices to run many show commands. Without single-connect, there will always be a 3-way TCP handshake for every command issued when command authorization is enabled. Belo...

Arne Bier · 09-10-2024

Hello I'm sure all of us would love to disable TLS 1.0/1.1 support in ISE to imrove security, but there's always something in the network that seems to make this dream impossible. I discovered today that CTS uses EAP-FAST under the covers, and on th...

Arne Bier · 08-03-2024

Hello, I am using the ISE OpenAPI to renew guest portal certificates. /api/v1/certs/system-certificate/{hostName} Get all system certificates of a particular node The API works well. However, after importing the new cert and private key, the old cer...

Arne Bier · 07-27-2024

Hello, I have been spending hours trying to get SNMPv3 Informs working on any Cisco IOS or IOS-XE and it's just not working for me. The reason I want to use Informs and not traps, is that Informs are more reliable and will be queued and retried if th...

Arne Bier · 10-05-2024

If the MACOS is working then it seems it's not a switch or a network issue. Check the config on the Windows host - it seems like the Windows host does not trust the ISE EAP System Certificate - therefore, install the necessary CA Cert Chain into the ...

Arne Bier · 10-05-2024

Depends a bit on the speed of your VM infrastructure - but I'd budget around 20-30 min per change - the application restart usually takes the bulk of the time.

Arne Bier · 10-05-2024

As Flavio hinted, the issue is most likely the CoA is not configured correctly. Check that the dynamic-authorization on the switch is configured with the IP address of the ISE PSN, and using the same shared secret. Plus, also specify the source inter...

Arne Bier · 10-04-2024

@Leo TI - the config looks like something out of a very old textbook - I would suggest to look at a more contemporary way of configuring this - and I would also suggest using a named aaa group, instead of the "group radius" - I have never used this s...

Arne Bier · 10-04-2024

I considered the requirement to allow UDP/3799 to be for 3rd party devices that implement the modern CoA port standard (e.g. Aruba) - and UDP/1700 used for Cisco devices only. But I had not thought about UDP/3799 being sent, even when a Cisco Catalys...

Member Since	‎02-23-2017 06:57 PM
Date Last Visited	‎10-05-2024 01:25 PM
Posts	3,531
Total Helpful Votes Received	5582

User Statistics

User Activity

Dynamic Authorization Failed - No Response has been received - CoA

How to setup TACACS+ single-connect properly and safely

How to disable TLS 1.0 in ISE when DNAC is used to provision devices?

is there an ISE OpenAPI Filters Reference Guide

SNMP INFORM Requests not working with SNMP version 3

Re: 802.1x Certificate based failed authentications on AWS ISE Server

Re: Cisco ISE - Move policy nodes to Admin/monitoring node

Re: Cisco ISE and Switch

Re: ISE Guest Access wired

Re: Dynamic Authorization Failed - No Response has been received - CoA