Team, I have a rather successful wired DOT1X solution using EAP-TLS (PKI) running on my Cat3850 network. Ok, it's using ACS still but I'll rollout a better authentication server in the months to come. I have had to add a layer of switching in front of my authenticator and now want to explore using NEAT by defining a supplicant configuration. I see that I have tried using username/password in the credentials and see my RADIUS light up with deny log entries - I expected to see this as I don't have an ACS access policy defined to allow connection. I am trying to use my pki by creating a trustpoint on this supplicant and the trying to define "pki-trustpoint <tp-name>" in my dot1x credentials. I'd expect to see something at the ACS related to my EAP-TLS attempts, but I see nothing. Is what I am trying to do even possible? Thanks, Chris   ... View more

Hello Team, Reference table 2 of http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/deploy_guide_c17-663760.html I have AnyConnect 4.4.00243 installed on my Microsoft Surface Pro (Windows 10), running great with my Catalyst 3850 with a "must secure" MACSEC policy. Its working great with EAP-TLS. Issue is, it's working too good. I have setup a Cisco CAT3850 as follows: Port 1 - Must Secure switchport (802.1X/AE) - I expect the supplicant to authenticate and encrypt the path. Port 2 - Authenticate only switchport  (802.1X) - I expect the supplicant to authenticate but be blocked(must-secure). Port 3 - Simple switchport in access mode (no authentication) - I expect the supplicant to be blocked(must-secure). I understand from Cisco's Identity-Based documentation that a Supplicant (AC4 on my Surface) with a "Must Secure" policy negotiating with the Authenticator (3850 Switch - Port 1) with a "Must Secure" policy produces a "SECURE" path. Therefore, I also understand from Cisco's Identity-Based documentation that a Supplicant with a "Must Secure" policy talking with a simple switch with no concept of MACSEC's "Must Secure" produces a " BLOCKED " path from the aspect of AnyConnect. I don't appear to see a place to setup the Network Access Manager policy with a "must-secure" other than setting Authentication Policy > Allowed Wired Security to 802.1X with MacSec. When I use port 3 on my switch, a dhcp assigns me an ip-address and the Surface connects to the network. Why isn't this blocked? What is the setting for the NAM policy/xml file to respect the "must secure"? Thanks, Chris ... View more

Hello Team, I am running DHCP Services on a Cisco 1000V CSR: Cisco IOS XE Software, Version 03.16.01a.S - Extended Support Release Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.5(3)S1a, RELEASE SOFTWARE (fc1) with the following debug enabled: DHCP server packet debugging is on. DHCP server event debugging is on. -------- When using this configuration, everything works fine - ip helper through the firewall (with NAT). no ip domain lookup ip domain name domain.com ip dhcp smart-relay ip dhcp excluded-address 25.25.25.1 25.25.25.20 ! ip dhcp pool TERMINALDHCP network 25.25.25.0 255.255.255.0 default-router 25.25.25.1 domain-name domain.com dns-server 192.168.170.3 lease infinite update arp However, I need to make the reservations and the only current way I know how to do this is with the origin file definition: ip dhcp pool TERMINALDHCP origin file scp://dhcp:dhcppass@server/dhcp-dell.txt default-router 25.25.25.1 domain-name domain.com dns-server 192.168.170.3 lease infinite update arp This is the contents of that file: *time* Feb 12 2016 12:10 PM *version* 6 !IP address Type Hardware address Lease expiration 25.25.25.221 /24 id 0100.8064.e26a.d3 Infinite *end* The load appears to work right from the debug: Feb 18 12:41:39.916: DHCPD: New packet workspace 0x7F4979D53D28 (ID=0x82000044) Feb 18 12:41:39.918: DHCPD: checking IFS status. Feb 18 12:41:39.918: DHCPD: contacting agent scp://dhcp:dhcppass@server/dhcp-dell.txt (attempt 0) Feb 18 12:41:41.317: DHCPD: agent scp://dhcp:dhcppass@server/dhcp-dell.txt is responding. Feb 18 12:41:46.316: DHCPD: IFS is ready. Feb 18 12:41:46.316: DHCPD: reading bindings from scp://dhcp:dhcppass@server/dhcp-dell.txt. Feb 18 12:41:46.679: DHCPD: read 263 / 1024 bytes. Feb 18 12:41:46.679: DHCPD: parsing text line "*time* Feb 12 2016 12:10 PM Feb 18 12:41:46.679: DHCPD: parsing text line " Feb 18 12:41:46.679: DHCPD: parsing text line "*version* 6 Feb 18 12:41:46.679: DHCPD: route: Parsed version = 6 Feb 18 12:41:46.679: DHCPD: parsing text line " Feb 18 12:41:46.679: DHCPD: parsing text line "!IP address Type Hardware address Lease expiration Feb 18 12:41:46.679: DHCPD: parsing text line " Feb 18 12:41:46.679: DHCPD: parsing text line "25.25.25.221 /24 id 0100.8064.e26a.d3 Infinite Feb 18 12:41:46.679: DHCPD: creating binding for 25.25.25.221 Feb 18 12:41:46.679: DHCPD: Allocated binding 7F492632BC48 Feb 18 12:41:46.679: DHCPD: Adding binding to radix tree (25.25.25.221) Feb 18 12:41:46.679: DHCPD: Adding binding to hash tree 7F492632BC48 Feb 18 12:41:46.679: DHCPD: parsing text line " Feb 18 12:41:46.679: DHCPD: parsing text line "*end* Feb 18 12:41:46.679: DHCPD: read static bindings from scp://dhcp:dhcppass@server/dhcp-dell.txt. With the desired results of the show ip dhcp binding command everything appears correct to me. DHCPRTR#show ip dhcp pool TERMINALDHCP Pool TERMINALDHCP : Utilization mark (high/low) : 100 / 0 Subnet size (first/next) : 0 / 0 Total addresses : 1 Leased addresses : 1 Excluded addresses : 1 Pending event : none 0 subnet is currently in the pool : Current index IP address range Leased/Excluded/Total 25.25.25.221 25.25.25.221 - 25.25.25.221 1 / 1 / 1 DHCPRTR# Feb 18 12:42:28.288: DHCPD: exclusion [25.25.25.221, 25.25.25.221], subnet [25.25.25.221, 25.25.25.221], exclusion = 1 DHCPRTR#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type State Interface Hardware address/ User name 25.25.25.221/24 0100.8064.e26a.d3 Infinite Static Active Unknown DHCPRTR# Is there a way of doing this other than the "origin file"? If not, what am I doing wrong? I have researched this and everything appears to be working right - loading of the file into my bindings database. I have attached my debugs for both DHCP transactions (network and origin file). Thanks, Chris ... View more

Team, I am trying to run 1.5.2 with 6.0 - I know - current rev/documentation says up-to 5.5 only. Anyone have it working with 6.0? I've got a install of VSUM 1.5.2 in my 6.0 dev environment and I receive a bunch of shockwave flash errors - for all browers types (IE, Chrome, and Firefox). If I check the vSphere client, the plugin appears to have installed correctly - so its just a bunch of modules that won't load. Thanks, Chris ... View more

Team, I have attempted to create a IKEv2/IPSec between Cisco IOS and a StrongSwan VPN client. Is this even possible to do IKEv2/IPSec remote access with a Cisco IOS headend? Right now I am using PSK but will flip over to rsa-sig once I get the preliminary settings down. Consider the attached diagram… I am able to create an SA between the VPN client and the IOS Headend but the traffic doesn't appear to go through the IPSec trunnel we have. My "show crypto ipsec sa" counters show that the IOS Headend is only decrypting traffic. It doesn't appear to be encrypting. FLEXHEAD#show crypto ipsec sa interface: Virtual-Access1     Crypto map tag: Virtual-Access1-head-0, local addr 192.168.6.10    protected vrf: (none)    local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)    remote ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)    current_peer 192.168.6.2 port 4500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0     #pkts decaps: 204, #pkts decrypt: 204, #pkts verify: 204     #pkts compressed: 0, #pkts decompressed: 0     #pkts not compressed: 0, #pkts compr. failed: 0     #pkts not decompressed: 0, #pkts decompress failed: 0     #send errors 0, #recv errors 0      local crypto endpt.: 192.168.6.10, remote crypto endpt.: 192.168.6.2      plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet1      current outbound spi: 0x5E744D59(1584680281)      PFS (Y/N): N, DH group: none      inbound esp sas:       spi: 0x4D128576(1293059446)         transform: esp-gcm ,         in use settings ={Tunnel UDP-Encaps, }         conn id: 2029, flow_id: CSR:29, sibling_flags FFFFFFFF80000048, crypto map: Virtual-Access1-head-0         sa timing: remaining key lifetime (k/sec): (4608000/2739)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE(ACTIVE)      inbound ah sas:      inbound pcp sas:                 outbound esp sas:       spi: 0x5E744D59(1584680281)         transform: esp-gcm ,         in use settings ={Tunnel UDP-Encaps, }         conn id: 2030, flow_id: CSR:30, sibling_flags FFFFFFFF80000048, crypto map: Virtual-Access1-head-0         sa timing: remaining key lifetime (k/sec): (4608000/2739)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE(ACTIVE)      outbound ah sas:      outbound pcp sas: I also don't appear to be using any pool ip addresses: FLEXHEAD#show ip local pool flexpool  Pool                     Begin           End             Free  In use  flexpool                 192.168.10.5    192.168.10.10      6       0 Available addresses:    192.168.10.5                                       192.168.10.6                                       192.168.10.7                                       192.168.10.8                                       192.168.10.9                                       192.168.10.10                                   Inuse addresses:      None FLEXHEAD# Here is my IKEv2 SA: FLEXHEAD#show crypto ikev2 sa  IPv4 Crypto IKEv2  SA  Tunnel-id Local                 Remote                fvrf/ivrf            Status  1         192.168.6.10/4500     192.168.6.2/4500      none/none            READY         Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK       Life/Active Time: 86400/3083 sec  IPv6 Crypto IKEv2  SA  FLEXHEAD# Here is my configuration: aaa new-model ! ! aaa authentication login AUTH local aaa authorization network NET local  ! aaa session-id common ! username cisco password 0 cisco ! ! crypto ikev2 authorization policy flex_dtu   pool flexpool  netmask 255.255.255.0  include-local-lan  route set interface ! crypto ikev2 proposal flex_dtu   encryption aes-cbc-256  integrity sha256  group 14 ! crypto ikev2 policy flex_policy   proposal flex_dtu ! crypto ikev2 keyring flexdtu  peer dtu   address 192.168.6.0 255.255.255.0   pre-shared-key cisco  ! ! ! crypto ikev2 profile flex_dtu  match identity remote any  authentication remote pre-share  authentication local pre-share  keyring local flexdtu  virtual-template 1 ! crypto ipsec transform-set FLEXDTU esp-gcm   mode tunnel ! crypto ipsec profile DTUIPSEC  set transform-set FLEXDTU   set ikev2-profile flex_dtu ! interface GigabitEthernet1  description WAN access for StrongSwan VPN  ip address 192.168.6.10 255.255.255.0  negotiation auto ! interface GigabitEthernet2  description LAN access to Server  ip address 192.168.10.1 255.255.255.0  negotiation auto ! interface Virtual-Template1 type tunnel  ip unnumbered GigabitEthernet1  tunnel source GigabitEthernet1  tunnel mode ipsec ipv4  tunnel protection ipsec profile DTUIPSEC ! ! ip local pool flexpool 192.168.10.5 192.168.10.10 ip forward-protocol nd ! end   Thanks Chris ... View more