This issue is also connected to version 19.3.0. ... View more

Hello, I'm not sure is this is correct discussion group but I think yes, because I need some developer answer. Maybe somebody here can help. Use case in short: guest is connecting to "free wifi" (mab filtering) guest is redirecting to external guest portal with some cripting on server-side (this is not ISE build-in guest portal, but external web server with some custom logic) guest insert login and pass in external guest portal external portal verify guest against ISE and starts CoA (this is the step where I have question) my setup: WLC v8.5, ISE v2.3  external guest portal is running on Linux machine (apache2/nginx with php capapilities) above described steps in detail: step1a: WLC and ISE configuation is clear. with redirection is operational. no problem here. step1b: ISE configuration is clear. ISE send in RADIUS answer some av-pairs: cisco avp: "url-redirect=https://<ext-portal>/?sessionId=sessionIdValue" ("sessionIdValue" string is replacing with session id by ISE) cisco avp: "url-redirect-acl=acl-redirect" step2a: guest is connected and checking internet connectivity. matches (deny definition) ACL (defined in "url-redirect-acl" radius answer from step1b). WLC send back to guest "HTTP Location: <redirecting-location>" (redirecting location is "url-redirect" value from radius answer in steb1b) step2b: guest sends "GET https://<ext-portal>/?sessionId=sessionIdValue" step2c: script on ext-portal get's guest data (It is not possible use RestAPI for this reason. this is only one option how to get information from guest). How to get "session information" values: GET https://<ise>/admin/API/mnt/Session/Active/SessionID/<sessionId>/0 <activeSessionList noOfActiveSession="1"> <activeSession> <calling_station_id>6C:FA:A7:44:D8:B6</calling_station_id> <orig_calling_station_id>6c-fa-a7-44-d8-b6</orig_calling_station_id> <session_state_bit>0</session_state_bit> <session_source>0</session_source> <acct_session_time>0</acct_session_time> <nas_ip_address>192.168.119.10</nas_ip_address> <framed_ipv6_address/> <auth_method>mab</auth_method> <auth_protocol>Lookup</auth_protocol> <endpoint_policy>Microsoft-Workstation</endpoint_policy> <server>lab-ise</server> <paks_in>0</paks_in> <paks_out>0</paks_out> <bytes_in>0</bytes_in> <bytes_out>0</bytes_out> </activeSession> </activeSessionList> step3: guest is entering login and pass. webform's action send data back to external guest portal (server side). in other words I have: from my guest portal: username password from ISE (see previous step) sessionId (this is "session id" for ISE and I think shared with WLC) calling_station_id (this is MAC address of the guest) nas_ip_address (this is IP address of the WLC) step4: QUESTION Note: Both methods are initiated from PHP script running on external portal RADIUS method: AUTH part: I can authorize login+pass to RADIUS server (it is working, radius server is ISE) CoA part: QUESTION1: if auth is passed, then I need send RADIUS CoA to WLC (I'm not sure how correct can I build RADIUS CoA pattern - see end of this post) or "HTTP" method: QUESTION2: Another solution can be (can be?) "HTTP call" from script directly to build-in guest portal (ISE) with information in answer about "authentication state". When auth is correct, CoA process is started (is it?) from ISE point of view (Am I correct?). Everything till step4 is clear and working. I'd like to solve QUESTION1 (build correct CoA to WLC) because i think it's better solution. If it's not possible, my other QUESITION2 is about authenticating guest against HTTP build-in (ISE) portal as backend HTTP call from ext-portal script if it's possible. I'm starting from this document: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html. Here is part of PHP script with CoA list of parameters that are sending to WLC (RADIUS_* are constants based on RFC radius atributes): radius_create_request($res, RADIUS_COA_REQUEST); radius_put_addr($res, RADIUS_NAS_IP_ADDRESS, $nas_ip_address); radius_put_string($res, RADIUS_CALLING_STATION_ID, $calling_station_id); radius_put_string($res, RADIUS_USER_NAME, $user); radius_put_vendor_string($res, RADIUS_VENDOR_CISCO, RADIUS_CISCO_AV_PAIR, "subscriber:command=reauthenticate"); // radius_put_string($res, RADIUS_ACCT_SESSION_ID, $sessionId); << I'm not sure if this is required Can anybody help with this? Thanks. At the end: I can't use build-in ISE guest portal because above described scenario is a part of bigger customized solution for customer. ... View more

Hello, I have simple network problem - I can't connect to the vWLC message interface... but solution seems to be not so easy. Let's have a look closer to the issue. In my subnet are connected: virtual ISE, virtual WLC, Cisco AP and some clients (PC). (virtual devices are running on VMware workstation on my laptop). I can "ping" WLC from all devices but from WLC I can't "ping" no device (no FW on the devices). MAC addresses in the ALL network devices are correct. The question is, why I can't connect to other devices FROM WLC. In the final, ISE and WLC can't communicate (RADIUS) and no http connection to WLC is possible. IP adresses: gateway: 192.168.10.1 laptop: 192.168.10.11 WLC: 192.168.10.231 ISE: 192.168.10.232 web server: 192.168.10.233 troubleshooting from gateway router (mikrotik): ARP table: 192.168.10.11 F4:30:B9:CF:5C:56 VLAN10 192.168.10.232 00:0C:29:68:35:D7 VLAN10 192.168.10.233 00:0C:29:5B:49:17 VLAN10 192.168.10.231 00:0C:29:D2:41:73 VLAN10 PING to all devices is running. from laptop (win): ARP table: 192.168.10.1 cc-2d-e0-c5-38-a6 dynamic 192.168.10.231 00-0c-29-d2-41-73 dynamic 192.168.10.232 00-0c-29-68-35-d7 dynamic 192.168.10.233 00-0c-29-5b-49-17 dynamic PING to all devices is running. from web server (linux): $ arp -an ? (192.168.10.11) at f4:30:b9:cf:5c:56 [ether] on ens33 ? (192.168.10.12) at b0:e1:7e:45:51:2e [ether] on ens33 ? (192.168.10.244) at 6c:fa:a7:44:d8:b6 [ether] on ens33 ? (192.168.10.1) at cc:2d:e0:c5:38:a6 [ether] on ens33 ? (192.168.10.231) at 00:0c:29:d2:41:73 [ether] on ens33 ? (192.168.10.232) at 00:0c:29:68:35:d7 [ether] on ens33 ? (10.215.87.191) at b0:e1:7e:45:51:2e [ether] on ens33 PING is running correctly to ALL devices in this subnet. and on the WLC: PING is not answered, but ARP table looks correct: CC:2D:E0:C5:38:A6 192.168.10.1 1 0 Host F4:30:B9:CF:5C:56 192.168.10.11 1 0 Host 00:0C:29:68:35:D7 192.168.10.232 1 0 Host 00:0C:29:5B:49:17 192.168.10.233 1 0 Host MAC records on all devices are correct. debug from WLC point of view (arp record for .233 not exists): (Cisco Controller) >ping 192.168.10.233 Send count=3, Receive count=0 from 192.168.10.233 *emWeb: Oct 02 12:05:21.370: dtlArpFindMobile: No ARP entry found 192.168.10.233 *emWeb: Oct 02 12:05:35.626: dtlArpFindMobile: No ARP entry found 192.168.10.233 Send count=3, Receive count=0 from 192.168.10.233 the same "debug arp all" when arp record exists: !!! note: this is ping attempt from 192.168.10.233: (Cisco Controller) > *dtlArpTask: Oct 02 12:09:59.272: processEtherIcmp: Received ICMP request from wired client, Interface no:1, mtu:1280, SRC MAC: 00:0C:29:5B:49:17 *dtlArpTask: Oct 02 12:09:59.272: processEtherIcmp: Sending ICMP reply Successful !! , SRC MAC: 00:0C:29:D2:41:73 *dtlArpTask: Oct 02 12:10:00.296: processEtherIcmp: Received ICMP request from wired client, Interface no:1, mtu:1280, SRC MAC: 00:0C:29:5B:49:17 *dtlArpTask: Oct 02 12:10:00.296: processEtherIcmp: Sending ICMP reply Successful !! , SRC MAC: 00:0C:29:D2:41:73 *dtlArpTask: Oct 02 12:10:02.440: dtlARPProtoRecv: Arp request. from = 1, client: 00:0c:29:5b:49:17, src ip: 192.168.10.233, tgt ip: 192.168.10.231 mscb: not found *dtlArpTask: Oct 02 12:10:02.440: Received dtlArpRequest sha: 00:0c:29:5b:49:17 spa: 192.168.10.233 tha: 00:00:00:00:00:00 tpa: 192.168.10.231 intf: 1, vlan: 0, node type: 1, mscb: not found, isFromSta: 0   !!! learned ARP table: (Cisco Controller) >show arp switch MAC Address IP Address Port VLAN Type ------------------- ---------------- ------ ------ ------ 00:0C:29:5B:49:17 192.168.10.233 1 0 Host B0:8B:CF:A2:E0:38 192.168.10.251 1 0 Host !!!note: and ping (Cisco Controller) >ping 192.168.10.233 Send count=3, Receive count=0 from 192.168.10.233 tcpdump on the 192.168.10.233 shows no icmp packets coming from WLC (192.168.10.231) I tried several versions of WLC (8.3, 8.5, 8.8). I tried upgrade/reinstall wmvare workstation. But till now no solution. The simple problem, but not so simple answer. What else can I try? martin ... View more

Hello, I can't solve issue with failover outage. Setup: 2x virtual FTD (ASA 9.9, firepower 2.3) running in failover in DC1 (ESX-A) is runnig: FTD-1, SERVER-1 in DC2 (ESX-B) is runnig: FTD-2, SERVER-2 FTD is running transparent (bridge) mode NW design: [ESX-A]-(trunk)-[SW-DC1]-(trunk)-[SW-CORE]-(trunk)-[SW-DC2]-[ESX-B] Issue: test1: manual failover to FTD-2: connectivity to SERVER-2 is without outage during failover but connectivity to SERVER-1 (the same DC as previous active FTD) is lost for 30sec test2: manual failover to FTD-1: connectivity to SERVER-1 is without outage during failover but connectivity to SERVER-2 (the same DC as previous active FTD) is lost for 30sec I have checked MAC address tables on all NW switches: during normal operation have all mac addresses correct directions to GW or SERVER during outage I can't see MAC address of the SERVER in VLAN connected to SERVER (between SERVER and FTD) (yes, this vlan is connected also to "real" NW world and virtual world on ESX) my question is:  how can I check/troubleshoot MAC address table on vSwitch? Is it possible? what kind of timeout is 30sec? martin ... View more

Hello, is it possible combine NIC pair and VLAN interfaces?   This information from documentation is not clear for me: VLANs (see Virtual Local Area Networks (VLANs)) are only allowed on the primary interface.   ^^ that means, on primary NIC is it possible, but not in backup interface?   link to doc: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_0100101.html#con_1122852   ... View more

Hello, I'd like to ask you what is necessary to configure for processing industry standard X.224 (ISO 8073) protocol. We have trouble with this type of communication protocol and scenario is for each tcp flow like this: - TCP is established between client and server (3-way handshake) - Connect Request (CR TPDU) from server side - Connect Confirm (CC TPDU) from client side - 30sec without any communication - then 10x TCP ZeroWindow (tcp keep-alive) packets * - after no answer from server side, client sends TCP Reset. this Reset is visible also on egress interface * I can see tcp zerowindow packet on ingress interface but no packet on egress port. There is no access list, no restriction on the interface. all communication is tcp based on port 102. no log record, nothing. What special can I configure for processing this industry protocol? How can I troubleshoot this issue? thanks for reply, martin ... View more

Hello everybody, I'd like to solve this issue. TCP flow between client (vlan422) and server (vlan423) has several HTTP flows. Last one transmits all packet but last one before HTTP 200 packet is not delivered to client. It is possible to see re-transmission attempts but no packet is send to client side. In the final, more HTTP flows are completed but last one is not complete transferred from server-side to client-side. The packet is 328bytes, has correct seq and ack numbers. No relevant log message in log file. No NAT for this communication, no seq-number randomization. No relevant bug or release notes for this 'issue'. On ASA box is no inspection drop, no IPS or any other feature that can drop the packet. What else can I check on the ASA? ASA 8850-20 v9.1(2)   ... View more

Hello, anyconnect is not caching/saving connection profiles locally. drop-down list is empty. in other words, %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile has no profile.xml files. I tried reinstall anyconnect, without solution. sw: anyconnect - 3.1.06073, windows 8.1 x64   thanks for help, martin ... View more

hello, vlan is possible configure only on physical NIC (ironport esa doc). nic pairing is possible configure betwen two data interfaces (combination rj45 + fiber is possible). I have question about combination vlan + nic pairing (I have no esa in the lab, I can't verify it), because I'd like connect ESA redundantly. Is it possible configure this scenario?: - configure the same vlan (vlan10, 20) on both data interfaces (data1, data2) (I'm not sure) - define ip address for vlan10 and vlan20 virtual interface - and in the final pair data1 and data2 into one 'nic pair' interface thanks, martin ... View more