Hi, I have a task to swap-out  two ASA single-mode firewalls. They are in a pair and neither has failed, this is merely a hardware upgrade. I am tempted to failover i.e. enter "no failover active" and replace the Primary unit first. However if I left the HA pair in their current configuration and replaced the Secondary, without failing over, the Primary should be able to keep working. The firewalls should then sync from Primary to Secondary.   Once I replace the Primary I can then failover by entering "no failover active" and then replace the Secondary.   Is anyone aware of an official procedure to replace a failover pair where both are working?   Thanks   ... View more

We are using a default Wired_MAB configuration. As I understand it a device tries to authenticate and as part of this the identity store i.e. the local internal identity store is queried. If this is a new device it isn't in the Identity Store, however our new device seems to get added. Is it the case that authentication proceeds after MAB with ISE continuing to Authorization Rules, if a device passes profiling it is added to the Identity Store and having been added, at THAT point authentication can now be successful? It has always seemed odd to me that there does not seem to be a failure condition within Authentication for MAB devices, however if a device fails to profile i.e. Authorize, it also fails authentication. Can someone clarify this? Thanks ... View more

I have taken over a solution which employs MAB for wired devices which are not configured for dot1x  e.g. some IP Phones. The laptops are all dot1x compliant and they must be using dot1x to access the network. The MAB devices are recognised as such and they are profiled correctly as IP Phones, using the standard Cisco ISE Profiling Policies which employ a "cdpcacheplatform" value. They are therefore authorised to access the network. However I am able to take a MAC address off of one of the MAB devices, power it down, configure that MAC address on a non-dot1x laptop (an illegal device) and it gains access to the network. ISE reports that the device is still an IP Phone. Surely if ISE can profile this device as a phone, using the Authorisation rule in the Policy Set, then when the port goes down and I plug a laptop into the port, ISE should detect that it is no longer a phone and re-profile it. My understanding is that MAB relates to Authentication rather than Authorisation and it is the Authorisaiton that I would expect to reoccur. I have read the Cisco papers however while they state that MAB does not prevent MAC spoofing, they do not state that profiling cannot be used to mitigate the risk.   Has anyone a clear view on the relation of MAB to profiling and CoA?   Thanks   ... View more

Hi, If anyone could help with this I'd appreciate it. I've configured an ACS 5.3 system and all my groups etc fucniton corrcetly both for Network Access and for Device Administration. However I'm stuck trying to allow clients to authenticate against the router's web-page i.e. Web-Authenticaiton, using TACACS+ between the router and the ACS5.3. I've looked into this and I need to configure a custom-attribute of "service" with type Outbound and link this to an Authorization policy. I feel that configuring the Custom Attributes is where I'm stuck. Once agin thanks for any help, Brian ... View more