Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Jason Mann
Stats
Member since
03-17-2006
12
Posts
0
Helpful
0
Solutions
Created by
Jason Mann
in Network Access Control
in Network Access Control
12-21-2018
11:16 AM
12-21-2018
11:16 AM
Trying to setup ISE to do TACACS with CSM 4.17. I have the authentication working but not able to authroize. I am trying to setup a shell profile but cant find how to set the roles?
... View more
Labels:
Created by
Jason Mann
in Network Management
in Network Management
09-20-2018
11:55 AM
09-20-2018
11:55 AM
Did you ever get this figured out?
... View more
Created by
Jason Mann
in Automation and Analytics
in Automation and Analytics
08-29-2018
05:10 PM
08-29-2018
05:10 PM
I am having trouble getting the Rules Input variable to work correctly. I have selected Fix for the scope and included the variable in my cli fix screen but when I try to run the fix for the compliance job I just get "Fix Input not available" I have included some screenshots. Anyone ran into this or know how to fix?
... View more
- Tags:
- compliance
Labels:
Created by
Jason Mann
in Network Security
in Network Security
08-10-2018
07:06 AM
08-10-2018
07:06 AM
Wondering if Cisco FMC can be used like Panorama to manage ASA's not running the threat defense software. We want to use FMC to manage the firewall config running normal code.
... View more
Labels:
06-22-2017
08:22 PM
I was watchhing the cisco live presentation BRKSEC-3054 - IOS FlexVPN Remote Access, IoT and Site-to-Site advanced Crypto VPN Designs (2017 Berlin) and it mentioned in a slide iWan3.x LISP/ESON. I cannot find any info on this and was curious if anyone has any info or worked with it?
... View more
- Tags:
- LISP ESON iWAN
Labels:
Created by
Jason Mann
in Network Access Control
in Network Access Control
01-13-2014
11:11 AM
01-13-2014
11:11 AM
On the 2960's we are running 12.2(55)SE5, on the 6500's we are running 15.1(1)SY We didn't use any kind of ACL because we start all of our switch ports into a black hole vlan. I have been watching sessions from Cisco Live 2012 and looks like Cisco is now recommending that you don't go closed mode unless absolutely necessary because it is hard to maintain and function.
... View more
Created by
Jason Mann
in Network Access Control
in Network Access Control
01-09-2014
08:26 AM
01-09-2014
08:26 AM
The issue we are running into is that when we initially deployed 802.1x we had the command “authentication open” on all of our switch ports. We ran a CscoWorks job last week Thursday to remove that command from all of our ports. Since that time we have ran into a couple of weird issues where the device was powered up but the switch port would show notconnect when doing a show int status but the speed would show a-1000 and duplex would show a-full. There would be no mac address listed when doing a “show mac add int ‘interface’” and the device would be in the MAB running state. This is happening on devices that are supposed to be doing 802.1x and MAB authentication, if we put the command “authentication open” back onto the port it showed connected and mac address. Now we have over 1000 switches on the network with this command removed and so far have only ran into a couple of these odd ball problem ports so at this time it is not happening widespread but would like to take care of the issue or figure out why this happening before it does.
... View more
Labels:
06-20-2012
08:09 AM
Hello all, I am curious how people are dealing with printers and 802.1x. We are using MAB to authenticate the devices which works fine. We have begun to implement the black hole concept as our next phase. We have built a vlan 86 that is strictly layer 2, we put all of the ports into that vlan and then use dynamic vlan assignment to place them into the correct vlan. That too works fine, the issue we have been running into is when the printer goes into hibernate/sleep mode. I am guessing that causes an up/down event on the switch which will cause the 802.1x authentication process to start over. When that happens the devices end up in vlan 86 and MAB is stuck in the running state because the device is not talking on the network. I have tried enabling ip device tracking but that didn't help. I am going to setup a ping probe using InterMapper to ping the device and see if that keeps it active but I am curious if anyone out there has ran into issues with printers and if so how have they dealt with them. Thanks!
... View more
Labels:
Created by
Jason Mann
in Network Access Control
in Network Access Control
06-18-2012
03:47 PM
06-18-2012
03:47 PM
Anybody have an idea?
... View more
Created by
Jason Mann
in Network Access Control
in Network Access Control
06-11-2012
12:59 PM
06-11-2012
12:59 PM
I was talking with a co-worker about multi-auth host mode and we are wondering how does it handle broadcast traffic. So if we have a switch port set to multi-auth and we are doing dynamic vlan assignment. Say you have an esx host device running 5 vm instances, if three of them pass and get assigned vlan 32, the other two fail and get assigned vlan 86. When a broadcast goes out on vlan 32, will the devices that are in vlan 86 see the broadcast traffic?
... View more
Labels:
01-11-2009
03:17 PM
That is what I was afraid of. What has happened is that 172.26.2.10 needs to talk with 10.144.230.200. Both of the user's intiate the conversation. The PUB vrf runs to a firewall back at our main building and the USER vrf runs to an aggregate router in our main building. We are trying to alleviate the hops that these two users take to talk to each other but we don't want to distribute all of the routes between the two VRF's so that is why we put in the export maps. Is there a way to export a single host so that each of the vrf's will know it about the hot but not the rest of the network? Thanks!
... View more
01-11-2009
12:50 PM
Actually have two questions on the below config. We are trying to share a single route between two vrf's on the same router. The below config is not workig. Also does an export map pertain to the whole vrf or just the rt is if it is set in the route-map? Thanks! ip vrf PUB rd 20:7 export map PUBvrf-export route-target export 20:7 route-target import 20:7 route-target import 10:10 ! ip vrf USERS rd 20:2 export map STATEvrf-export route-target export 20:2 route-target import 20:2 route-target import 10:99 ! interface FastEthernet0/1.10 description USERS VRF encapsulation dot1Q 10 ip vrf forwarding USERS ip address 10.144.230.1 255.255.255.0 ! interface FastEthernet0/1.99 description PUB VRF encapsulation dot1Q 99 ip vrf forwarding PUB ip address 172.26.2.1 255.255.255.0 ! router ospf 3482 router-id 10.194.184.20 log-adjacency-changes detail auto-cost reference-bandwidth 100000 area 500 authentication message-digest area 500 stub network 10.0.0.0 0.255.255.255 area 500 ! router bgp XXXX no synchronization bgp log-neighbor-changes neighbor ALL_RR peer-group neighbor ALL_RR remote-as XXXX neighbor ALL_RR update-source Loopback0 neighbor ALL_RR send-community both neighbor 10.194.184.1 peer-group ALL_RR neighbor 10.194.184.2 peer-group ALL_RR neighbor 10.194.184.3 peer-group ALL_RR no auto-summary ! address-family vpnv4 neighbor ALL_RR send-community both neighbor 10.194.184.1 activate neighbor 10.194.184.2 activate neighbor 10.194.184.3 activate exit-address-family ! ! address-family ipv4 vrf USERS redistribute connected no synchronization exit-address-family ! address-family ipv4 vrf PUB redistribute connected no synchronization exit-address-family ! ! ip prefix-list PUBvrf-nets seq 5 permit 172.16.2.10/32 ip prefix-list USERSvrf-nets seq 5 permit 10.144.230.200/32 ! route-map PUBvrf-export permit 10 match ip address prefix-list PUBvrf-nets set extcommunity rt 10:99 additive ! route-map USERSvrf-export permit 10 match ip address prefix-list USERSvrf-nets set extcommunity rt 10:10 additive
... View more
Labels:
12-21-2018
Trying to setup ISE to do TACACS with CSM 4.17. I have the
authentication working but not able to au...
Created by
Jason Mann
in Network Management
09-20-2018
09-20-2018
Did you ever get this figured out?
08-29-2018
I am having trouble getting the Rules Input variable to work correctly.
I have selected Fix for the ...
08-10-2018
Wondering if Cisco FMC can be used like Panorama to manage ASA's not
running the threat defense soft...
06-22-2017
I was watchhing the cisco live presentation BRKSEC-3054 - IOS FlexVPN
Remote Access, IoT and Site-to...
Created by
Jason Mann
in Network Access Control
01-13-2014
01-13-2014
On the 2960's we are running 12.2(55)SE5, on the 6500's we are running
15.1(1)SYWe didn't use any ki...
Created by
Jason Mann
in Network Access Control
01-09-2014
01-09-2014
The issue we are running into is that when we initially deployed 802.1x
we had the command “authenti...
06-20-2012
Hello all, I am curious how people are dealing with printers and 802.1x.
We are using MAB to authent...
06-11-2012
I was talking with a co-worker about multi-auth host mode and we are
wondering how does it handle br...
Created by
Jason Mann
in Routing
01-11-2009
01-11-2009
That is what I was afraid of. What has happened is that 172.26.2.10
needs to talk with 10.144.230.20...
Public Statistics
| Date Registered | 03-17-2006 11:11 AM |
| Date Last Visited | 12-28-2018 11:17 AM |
| Total Messages Posted | 12 |
