Howdy,   For anyone that had to discover this the hard way, there is a workaround if you like to continue using SFTP repositories while having Patch 4 applied. Having spent close to a day on that, it would appear that the problem is arround the host keys ISE is trying to use while opening the SFTP channel. What i saw happening is that when you SSH from ISE on to the repository it uses ECDSA keys, where triggering SFTP connection was using RSA keys instead. This ultimetly triggers an error SSH Connect error as it did not match the known hosts keys as they are differnt In our case we use a CentOS server as SFTP repository and simply turnig off negotiation of ECDSA in the /etc/ssh/sshd_config  and restarting the sshd service allows the SFTP connections to work as normal. This is the settings we changed:   From:   HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key   To: HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key   Although its not ideal, it allows to workaround the problem, while not reverting to say FTP.   Hopefulyl this will help others, as looking for "SSH Connection Error" did not bring this bug up.   Niko ... View more

Hi Guys   I'm having major trouble getting my ISE box to respond to proxied requests from external radius servers. Does anybody know how to configure an authentication rule to process proxied radius requests. Cant find much documentation on it.   I can see the requests from the outside radius servers hitting my ISE box, its just ISE isnt responding.   12:43:37.052369 IP (tos 0x0, ttl  59, id 29969, offset 0, flags [none], proto: UDP (17), length: 178) earlgrey.heanet.ie.tdp-suite > RCSI-ISE-01.radius: RADIUS, length: 150 Access Request (1), id: 0x21, Authenticator: 0c4f44e0994cb0ebfa89b1194b3d075b  Username Attribute (1), length: 20, Value: johncolfer@rcsi.ie  NAS IP Address Attribute (4), length: 6, Value: localhost.localdomain  Calling Station Attribute (31), length: 19, Value:  [|radius] [|radius]   Any help would be great.   Thanks   john ... View more

Hi   I'm looking for a little help configuring ISE to proxy requests to external radius servers based on email address and password. I want to configure eduroam on our WLAN. Eduroam allows students connect to the WIFI of other Campuses using their local credentials   Workflow: User associates to SSID (eduroamTest) Prompted for username & password (802.1x) User puts in username and password in the form joebloggs@university.com (UPN) If the user is part of our local institution they are authenticated using our local radius server (ISE) If the user is a  member of a partner institution the request is proxied to an external radius server (National Gateways). The National Gateways  passes the request to the relevant institution based on the UPN (eg @ucd.ie will be passed to ucd radius servers) The institution authenticates the user and passes the  request back to the National Gateways The National Gateways passes this request back to our ISE server and the external user is authenticated The user can browse the web   What I have done: Setup the National Gateways as external proxy servers Created firewall rules to allow the traffic Configured the proxy sequence with these servers Created a policy to proxy requests to the proxy sequence   What I need to figure out: How to get ISE to authenticate/proxy requests, for the SSID eduroamTest, based on UPN eg (if username = *@rcsi.ie then use local ISE otherwise use proxy service) Any help with this configuration would be greatly appreciated as I am new to ISE.   If you need any more info please let know.   Kind regards   John   ... View more

Hi, we updated our NAC appliances from 4.8.1 to 4.9 and have noticed that web authentication is no longer woking on Apple IOS devices. We had setup a user page for the MAC_ALL OS and iphones etc. were able to authenticate using thier browser ok. Now (after the upgrade) after they authenticate they receive the below warning. There doens't seem to be any other config changes we can make for the IOS device so any advice would be useful. Thanks ... View more

Hi, I have a clean access server configured as OOB real IP gateway. The clients are placed in authentication VLANs on the edge of the LAN that are a couple of L3 hops from the CAS. We have policy based routing configured to pass client traffic from the authentication VLANs  to the CAS. Once the client is certified it is popped into the clients access VLAN. All worked ok except that the NAC agent keeps popping up after successful login, attempting to login again. I have now deployed an ACL to drop traffic from the client Access VLANs to the CAS so the client doesn't keep poppin up. As far as I can see there is a SWISS service running with the agent that keeps sending data packets to the CAS and causes ths agent in our case to keep trying to authenticate again and again. The ACL I created prevents these packets and stops the continuing login attampts. The annoying this is that the client can't update its user IP details in the CAM logs when I apply this ACL. Is this by design? I would have thought once the client is logged on then the agent wouldn't need to keep trying to log on again. The CAS/CAM/agents are running  at version 4.7.2 ... View more