Dears, we have fingerprint machines, when connecting the machine to a port configured for dot1x the dot1x authentication fails, and MAB authentication keeps in running state as the result below. the mac address keeps unknow  Interface:  GigabitEthernet3/0/7           MAC Address:  Unknown            IP Address:  Unknown                Status:  Running                Domain:  UNKNOWN       Security Policy:  Should Secure       Security Status:  Unsecure        Oper host mode:  multi-domain      Oper control dir:  both       Session timeout:  N/A          Idle timeout:  N/A     Common Session ID:  0A0A6507000032815AE3D7D3       Acct Session ID:  0x000097C0                Handle:  0x8F000394 Runnable methods list:        Method   State        dot1x    Failed over        mab      Running and i receive the message below  %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Gi3/0/7 AuditSessionID 0A0A6507000032965B2927BB %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Gi3/0/7 AuditSessionID 0A0A6507000032965B2927BB %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Gi3/0/7 AuditSessionID 0A0A6507000032965B2927BB no port security is configured on the port. when we remove the dot1x configuration and configure port security we see the machine mac address on the port. switch ios Version 15.0(2)SE10a  switch hardware 3750 stacked. please advise, Thanks in advance. ... View more

Hi, I want to get a copy of the firesight connection events to a remote logging server. would anybody help with that.? i need a global configuration, as i have too many access policies and it will take to much time to add log server to this number of access policies. Thanks, ... View more

I used to use "Evaluate configuration validator" tool on cisco ISE, I checked all the devices on the network with this tool, but for a single switch 3750X the tool isn't able to connect to the switch, and i got the below message. Waiting to obtain connection parameters for Network Device 10.10.50.237. User Input Obtained. Connecting to Device... Error occurred while connecting to device (, CLI_INTERPRET_BACKSPACE=true, software=IOS, CLI_SEND_WAKEUP_WAIT_TIME=500, CLI_PROMPT_EXPECT=> #, CLI_SEND_WAKEUP_TRIES=10, CLI_TRANSPORT=ssh2, CLI_LOGIN_PASSWORD=**, CLI_LOGIN_USERNAME=maher.shaban, DEVICE_TIMEOUT=60000, CLI_AUTH_FAILURE_EXPECT=% Bad passwords % Login invalid % Authentication failed % Bad secrets % Access denied, CLI_PORT=22, CLI_ENABLE_PASSWORD=**, CLI_ENABLE_CONDITION=PASSWORD, CLI_SEND_WAKEUP_AUTH_RETRIES=0). by the way, the switch is operating normally, and IOS is updated. and the users work with  802.1X without any issues. would you please advise how to resolve that issue. Thanks, Maher ... View more

Hi  All, I've two ise node in a single group. the NAC agent is popping up properly when the traffic is redirected to the first node, but when the web traffic is redirected to the second node the agent doesn't pop up. i read about the issue, and i found that the solution is to add the second node as the discovery agent in the NAC agent as the screen below shows. the guys told i can put both ISE node names in the configuration on the server. but There appears to be a limit to the number of characters that you can enter in the Posture Agent Profile, Discovery Host field. When I attempt to enter the fqdn of both PDPs as : xyz-hqs-isepdp1.xyzhqs.com; xyz-hqs-isepdp2.xyzhqs.com it is truncated to: xyz-hqs-isepdp1.xyzhqs.com;xyz-hqs-isepdp2.xyzhqs. It appears that the limit is 50 characters. is that correct, that if i added both hosts to this place, the problem will be solved, and how can i solve the length limitation here to add both host FQDN. can i add the *.mydomain.local to fix that issue. Thanks in advance. ... View more