Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About aevans
11-05-2018
Stats
Member since
05-08-2006
38
Posts
12
Helpful
1
Solution
Created by
aevans
in Policy and Access
in Policy and Access
06-27-2018
02:23 AM
06-27-2018
02:23 AM
Hi, The way I fixed this was to remove all mobility licence off ISE and then install the new non mobility licences (base,plus & apex) the two different types can’t exist together. Regards Ant
... View more
03-23-2018
02:38 AM
Hi,
I have a question about how to migrate from mobility licences to standard base and plus licences. Due to the way the licencing works within ISE I am unable to install the base licence with a mobility licence already installed. They can't exist together!
My question is how are endpoints affected when I remove the mobility licences? For a short period of time ISE will have no licenses existing on the deployment until I install the base ones. This is a Hospital with around 2500 endpoints connected at any time so I need to understand the impact.
Has anybody else ever had to do this?
Thanks
Ant
... View more
Labels:
Created by
aevans
in Policy and Access
in Policy and Access
12-06-2017
01:27 AM
12-06-2017
01:27 AM
Anybody else have this issue? I would love to hear your thoughts...
... View more
Created by
aevans
in Policy and Access
in Policy and Access
11-16-2017
07:48 AM
11-16-2017
07:48 AM
Hi Everyone,
I have a question about how to enforce an SGT on a wireless network. My WLCs are a pair of 8510's which is obviously not capable of inline tagging (would have been much easier :)
During my testing I can see that when my test users gain access to the network the correct SGTs are being propagated but my issue is how to enforce between wireless clients. One option I have is to go to a later version where SXP and Flex-Connect are supported and configure local switching. This however is not what I want to do as I would then have to spread a L2 domain across my whole network.
Any ideas welcomed at this point
Ant
... View more
Labels:
01-04-2017
02:15 PM
Hi There,
Whilst I agree with Neno there is maybe merit in making a 2 node deployment to avoid outages. I guess it all depends on how big the environment is and how much work it would take to configure the NADs to point to both ISE servers.
If you are ok in having a large downtime window I would just crack on and upgrade the single node. If the window is short or you need minimal impact consider the approach above.
Cheers
Ant
Please rate helpful posts
... View more
01-04-2017
01:57 PM
Hi Gagan,
Thanks for getting back to me. I understand how to create the custom fields and their purpose my question is about creating a multi-choice drop down list. I can create the field but I see no way of populating the drop down menu.
Essentially I want the user to select 1 of three options and depending on their answer, will depend on what SGT they are assigned and what they can access in the network.
Cheers
Ant
... View more
01-03-2017
08:43 AM
Hi All,
I am working with a customer who would like to offer 3 levels of access on a guest network. Depending on what level of access you require it will email different people to approve.
What I would like to do is create a drop down box on the self-register portal which shows Level-1, Level-2 & Level-3. The issue I am having is I can create a multi choice box called "Required Access" but I can see no way of populating the drop down list with the various levels.
Has anybody manged to do anything similar and can point me in the right direction.
Cheers
Ant
... View more
Labels:
Created by
aevans
in Automation and Analytics
in Automation and Analytics
12-20-2016
03:15 PM
12-20-2016
03:15 PM
Will do. I would like to say a huge thank you to you for your blogs on PnP it's really helped me with the 1st iteration of what I want to achieve. Cheers Ant
... View more
Created by
aevans
in Automation and Analytics
in Automation and Analytics
12-16-2016
03:07 AM
12-16-2016
03:07 AM
Hi Adam, Thanks for the pointer. I have now modified my list config script to point to images and it works great. Thanks Ant
... View more
Created by
aevans
in Automation and Analytics
in Automation and Analytics
12-15-2016
09:16 AM
12-15-2016
09:16 AM
Hi All, I am currently working on automating the configuration creation and configuring APIC-EM PnP through the API's. I have found some very helpful stuff on here but I'm struggling to specify the image in the rule creation. I should add I'm very new to all this I only started with python a few days ago. Has anybody managed to specify this yet and if so could you possibly share how you have called the API. I have tried using the "imageName", "imageVersion" & "imageId" When I execute my script with "imageId" set it fails to create the rule. I think this may be trying to find the image locally and upload it. I am not after, what I want is to reference the image already uploaded in APIC-EM. If I use the other two it configures the rule but doesn't show the image in the rule. below is the output from the script "platformId": "WS-C2960X-48FPD-L", "hostName": "GB-N-RLH-SWA-02", "imageId": "c2960x-universalk9-mz.152-2.E5.bin", "pkiEnabled": true, "configId": "60ebfe3c-4ecf-456a-9b16-5c8f99f5f789", "serialNumber": "22345673276", "imageVersion": "c2960x-universalk9-mz.152-2.E5.bin" } ] Waiting for Task 75e12e6d-5da8-4348-b88b-24c91886ed50 Task=75e12e6d-5da8-4348-b88b-24c91886ed50 has not completed yet. Sleeping 2 seconds... { "progress": "Site Device (Rule) Creation Failed", "failureReason": "Failed to get the file", "startTime": 1481820555925, "errorCode": "InternalError", "rootId": "75e12e6d-5da8-4348-b88b-24c91886ed50", "version": 1481820555925, "id": "75e12e6d-5da8-4348-b88b-24c91886ed50", "serviceType": "Ztd Service", "isError": true, "endTime": 1481820555977 } Any help appreciated Ant
... View more
Labels:
11-30-2016
05:45 AM
Hi Jack,
Have you considered adding an authorization policy rule to look in guest endpoints (assuming this is the endpoint group your guest are placed in when they authenticate) and if so permit access?
This would need to be above your redirect rule.
Consider when doing this the settings for purging accounts.
Ant
... View more
11-30-2016
05:44 AM
Hi Jack,
Have you considered adding an authorization policy rule to look in guest endpoints (assuming this is the endpoint group your guest are placed in when they authenticate) and if so permit access?
This would need to be above your redirect rule.
Consider when doing this the settings for purging accounts.
Ant
... View more
11-30-2016
05:39 AM
Hi Philip,
Depending on how you AD is setup you can split them into different OU groups for instance OU=USERS & OU=ADMIN
Then you can have an Authz policy pointing to the USERS group.
Cheers
Ant
... View more
Created by
aevans
in Policy and Access
in Policy and Access
11-30-2016
05:30 AM
11-30-2016
05:30 AM
Hi All,
I'm having a strange issue when I use wired dot1x authentication. If I don't have any dot1x config on the switchport when I connect a domain laptop it shows up in the network connections as "domain network". When I apply my dot1x config the authentication is fine and I can see in the ISE operations tab that it is successful and pushes down the correct SGT and policy result, but it places the laptop in a public network which then applies windows firewall rules and I loose DNS etc etc.
I have attached some screen shots which should help. I should mention that everything works fine with a wireless authentication its just the wired I am having issues with.
Any pointers would be great.
Cheers
Ant
... View more
Labels:
11-24-2016
01:50 PM
Hi,
Did you manage to get this resolved? I am having a similar issue in my lab where the SGACLS seem to be ignored within the matrix but the default rule is being hit. I know this to be true as I have configured an SGACL to deny ICMP and permit the rest of the traffic. I have tested by changing this rule multiple times.
It looks to me like my tags are not being honoured within my network but I'm not sure why.
Cheers
Ant
... View more
06-27-2018
Hi,The way I fixed this was to remove all mobility licence off ISE and
then install the new non mobi...
03-23-2018
Hi, I have a question about how to migrate from mobility licences to
standard base and plus licences...
Created by
aevans
in Policy and Access
12-06-2017
12-06-2017
Anybody else have this issue? I would love to hear your thoughts...
Created by
aevans
in Policy and Access
11-16-2017
11-16-2017
Hi Everyone, I have a question about how to enforce an SGT on a wireless
network. My WLCs are a pair...
01-04-2017
Hi There, Whilst I agree with Neno there is maybe merit in making a 2
node deployment to avoid outag...
01-04-2017
Hi Gagan, Thanks for getting back to me. I understand how to create the
custom fields and their purp...
01-03-2017
Hi All, I am working with a customer who would like to offer 3 levels of
access on a guest network. ...
Created by
aevans
in Automation and Analytics
12-20-2016
12-20-2016
Will do.I would like to say a huge thank you to you for your blogs on
PnP it's really helped me with...
Created by
aevans
in Automation and Analytics
12-16-2016
12-16-2016
Hi Adam,Thanks for the pointer. I have now modified my list config
script to point to images and it ...
Created by
aevans
in Automation and Analytics
12-15-2016
12-15-2016
Hi All,I am currently working on automating the configuration creation
and configuring APIC-EM PnP t...
11-30-2016
Hi Jack, Have you considered adding an authorization policy rule to look
in guest endpoints (assumin...
11-30-2016
Hi Jack, Have you considered adding an authorization policy rule to look
in guest endpoints (assumin...
11-30-2016
Hi Philip, Depending on how you AD is setup you can split them into
different OU groups for instance...
Created by
aevans
in Policy and Access
11-30-2016
11-30-2016
Hi All, I'm having a strange issue when I use wired dot1x
authentication. If I don't have any dot1x ...
Public Statistics
| Date Registered | 05-08-2006 01:06 AM |
| Date Last Visited | 11-05-2018 09:05 PM |
| Total Messages Posted | 38 |
| Total Helpful Votes Received | 12 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
