Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About csco11552159
Stats
Member since
02-15-2015
97
Posts
32
Helpful
2
Solutions
Certifications
Created by
csco11552159
in Network Access Control
in Network Access Control
09-24-2018
12:27 PM
09-24-2018
12:27 PM
what if we deploy PSN to each "Site", witll ISE use site based DNS resolution to find all DC?
we do have all site based DNS resolution. If ISE is using this way, it should be able to see all DC at the "site".
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
09-21-2018
10:44 AM
09-21-2018
10:44 AM
checked with our AD admin, our DNS only resolve some of DC based on domain
but ISE seems not to use API or similar cmd like" nltest /dclist:xxx.com" to resolve the DCs.
if this is the case, PassiveID wont work for lots cases especially when large amount DCs in the enterprise.
No one will display 100 DCs based on domain name ....
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
09-20-2018
09:20 PM
09-20-2018
09:20 PM
Opened a ticket with TAC wait for some updates.
Psn with passive ID enabled only see the "site" DC which are auto associated with.
Passive wmi should see everything ..
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
09-20-2018
02:36 PM
09-20-2018
02:36 PM
we saw the same result for other domains. it seems site impacted PassiveID DCs....
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
09-20-2018
12:28 PM
09-20-2018
12:28 PM
Recently we are trying to add new DCs into PassiveID list to use WMI monitoring.
The problems how ISE find the DCs, in our Dev environment, we found some DCs are missing from the list. and we have no way to add them.
when use :
nltest /dclist:dev
We will see 4 DCs.
But from PassiveID "Add Domain Controllers" list, cannot find all of them.
Then we test our production DCs, we have same issues, some "site" DCs are totally missing.
Is some kind reasons about DC"Site" ?
How does ISE find all DCs available to add?
... View more
- Tags:
- PassiveID DC
Labels:
09-04-2018
12:42 PM
i see. thank you.
Do you know if there is a session limitation?
Like Agent method, in the document mentions that each agent can monitor 10 ADs.
Is there a limitation for WMI to monitor ADs ?
... View more
08-20-2018
02:08 PM
Hi,
do you know if i have PSN1 and PSN2 in same cluster, will both query same AD server? or PSN1 will query to AD1 and PSN2 query AD2? for remote Sites, how PSN query?
still try to understand the traffic flow.
... View more
08-20-2018
12:48 PM
Hi,
if we are using WMI to monitor all our DCs( over 100 in 2 forests), the account we used for WMI has to change the password every year .....
Is there a way to do a bulk edit to update the password?
2nd question, we have local PSN cluster and DCs have site setup.
once we enable WMI, will local PSN only contact local DC site? How does traffic sharing between multiple PSN in different cluster?
... View more
Labels:
Created by
csco11552159
in Network Access Control
in Network Access Control
07-12-2018
11:10 AM
07-12-2018
11:10 AM
so we have to change all our DC's registry to make it work ,right? will require the same setup for Server 16? thank you.
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
07-11-2018
11:46 AM
07-11-2018
11:46 AM
thank you. so if we manually created these keys, we can try to avoid "Full control", right ? regarding the key is adding, for 64 bit is located at, right? HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} AppID = {76A64158-CB41-11D1-8B02-00600806D9B6}
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
07-11-2018
07:27 AM
07-11-2018
07:27 AM
these 2 keys: HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6} HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
07-11-2018
07:21 AM
07-11-2018
07:21 AM
i m following the PIC document: https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/pic_admin_guide/PIC_admin/PIC_admin_chapter_01000.html#task_784A7… when we talk to our Corp Sec and ID team for changing registry key to allow our account with full control of DCOM/WMI key, they want to know the reason of the change. If we have Domain Admin account with read only access, will this do the work? anyone can explain why we need full control? this will be really help. thank you.
... View more
Labels:
Created by
csco11552159
in Network Access Control
in Network Access Control
07-10-2018
06:04 AM
07-10-2018
06:04 AM
thank you. i will send to FMC for now. hopefully some changes coming soon.
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
07-06-2018
07:00 PM
07-06-2018
07:00 PM
hi John & Hsing-Tsu, So in order FMC to have correct User ID, port and IP mapping, TS-Agent directly send to FMC? like this: TS-Agent--->FMC ISE---(pxgrid)--->FMC the way we try to do is : TS-Agent--->ISE ----(pxgrid)--->FMC. We can use TS-Agent to send mapping to ISE, then we should easily send all ID mapping to FMC via pxgrid including regular mapping and TS ports mapping. this more make sense. Will this way work?
... View more
Created by
csco11552159
in Network Access Control
in Network Access Control
07-06-2018
02:36 PM
07-06-2018
02:36 PM
Thank you. and on FMC, in this way will only keep the last user login.
... View more
Created by
csco11552159
in Network Access Control
09-24-2018
09-24-2018
what if we deploy PSN to each "Site", witll ISE use site based DNS
resolution to find all DC? we do ...
Created by
csco11552159
in Network Access Control
09-21-2018
09-21-2018
checked with our AD admin, our DNS only resolve some of DC based on
domain but ISE seems not to use ...
Created by
csco11552159
in Network Access Control
09-20-2018
09-20-2018
Opened a ticket with TAC wait for some updates. Psn with passive ID
enabled only see the "site" DC w...
Created by
csco11552159
in Network Access Control
09-20-2018
09-20-2018
we saw the same result for other domains. it seems site impacted
PassiveID DCs....
Created by
csco11552159
in Network Access Control
09-20-2018
09-20-2018
Recently we are trying to add new DCs into PassiveID list to use WMI
monitoring. The problems how IS...
09-04-2018
i see. thank you. Do you know if there is a session limitation? Like
Agent method, in the document m...
08-20-2018
Hi, do you know if i have PSN1 and PSN2 in same cluster, will both query
same AD server? or PSN1 wil...
08-20-2018
Hi, if we are using WMI to monitor all our DCs( over 100 in 2 forests),
the account we used for WMI ...
Created by
csco11552159
in Network Access Control
07-12-2018
07-12-2018
so we have to change all our DC's registry to make it work ,right? will
require the same setup for S...
Created by
csco11552159
in Network Access Control
07-11-2018
07-11-2018
thank you. so if we manually created these keys, we can try to avoid
"Full control", right ? regardi...
Created by
csco11552159
in Network Access Control
07-11-2018
07-11-2018
these 2 keys:
HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}HKLM\Software\Classes\Wo...
Created by
csco11552159
in Network Access Control
07-11-2018
07-11-2018
i m following the PIC document:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/pic_admin_gui...
Created by
csco11552159
in Network Access Control
07-10-2018
07-10-2018
thank you.i will send to FMC for now. hopefully some changes coming
soon.
Created by
csco11552159
in Network Access Control
07-06-2018
07-06-2018
hi John & Hsing-Tsu,So in order FMC to have correct User ID, port and IP
mapping, TS-Agent directly ...
Created by
csco11552159
in Network Access Control
07-06-2018
07-06-2018
Thank you.and on FMC, in this way will only keep the last user login.
Public Statistics
| Date Registered | 02-15-2015 07:01 PM |
| Date Last Visited | 12-05-2018 11:00 AM |
| Total Messages Posted | 97 |
| Total Helpful Votes Received | 32 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 2 | |
| 1 | |
| 1 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 2 | |
| 2 | |
| 3 | |
Anonymous
| 1 |
| 15 |
