About Pradeep S.R.

Pradeep S.R. · ‎05-02-2018

Customer is not willing for NAT on their side.

Pradeep S.R. · ‎05-01-2018

I have customer site A & B connecting to Datacenter C &D with same LAN subnet on Customer site A &B. Datacenter C&D will have site to site VPN tunnel to A&B. I have enabled RRI in the Datacenter firewalls.In essence both the datacenters will learn the same remote network and redistribute this network into IGP thus creating a routing conflict for all the remote sites which try to connect to the remote network. As you know RRI will always insert a static route irrespective of the tunnel status. I would like the remote location to always go through Data center C Site to site VPN tunnel and use Data center D in case of any issues with VPN tunnel on "C" side. Is there a way I can achieve VPN redundancy using this scenario.Please help me with this. Note:- customer is not agreeing for Natting the network on their side.

Pradeep S.R. · ‎08-22-2017

Hi Guys, I am planning to take 300-208 exam if i pass this will it renew my current ccnp routing certificate for 3 more years?. Please let me know ASAP as my current certificate expire in 2 weeks, quick input and suggestions appreciated

Pradeep S.R. · ‎06-24-2016

Hi Roman, We are using Anyconnect 4.2.02075 and ISE 1.4 version and all of sudden we seeing the certificate errors for some wireless(MAC OS) users. issue : client is trying to trust PSN local certificate but which is not configured for EAP authetication at all. how user is getting the response to trust the cert which is not configured?? Error screenshot attached.

Pradeep S.R. · ‎06-21-2016

Hi Jack, I want to keep MAB policy on top and dot1x policy below in authorization policy,- Yes If suppose HP Printers which are profiled as a HP -Device in ISE , can I statically map these device to a particular static group instead of automatic mapping to HP-Device- Yes you can do that. Cheers, Pradeep

Pradeep S.R. · ‎06-17-2016

Hi Jack, q 1? Yes you have to check endpoint details from Administration->Identity Management->Identities->Endpoints (screenshot attached) q 2? if you go the profiling architecture and CF (Certainty Factor) value - section guide it helps to u. Q 3? yes it helps- you can statically map failing device to particular group -it is feasible solution small scale deployment and for large scale dynamic profiling is better option.

Pradeep S.R. · ‎06-17-2016

Hi Jack, yes it is running and the PC NIC configuration are as the below link. please confirm that I am on the correct path. Yes you are on right path. Cheers, Pradeep

Pradeep S.R. · ‎06-17-2016

Hi Jack, system is hitting the deny policy as there is no 802.1x request from the PC and there is MAB authz allowed for that devices- that is reason you are getting that error, Do you configured MAB(Mac address bypass) authz policy for the windows devices? if yes please verify the policy. Problem looks like with PC just verify the wiredautoconfig service is running in PC? there are no certificate related errors? as you said some of the PC's are working then it clearly indicate problem with system not ISE, Ref Link: https://supportforums.cisco.com/blog/12256681/getting-past-intermittentunexplained-8021x-problems-windows-7 Microsoft https://support.microsoft.com/en-us/kb/2736878 Cheers, Pradeep

Pradeep S.R. · ‎06-13-2016

Hi Jack, I meant to say if none of the 3 options work then only we should go with authz policy without any profiling attribute in that- it means policy should not depend on any profiling parameter

Pradeep S.R. · ‎06-13-2016

Hi jack, To get the profiling accuracy - we should enable( DNS,DHCP,SNMP, SNMPTRAP, RADIUS) -profiler option in profiler configuration.- there are 4 options to achieve this. 1. check logs and see on which parameter device is getting profiled as HP device? (like radius,dns or dhcp). 2. u have to tweak the profiling policy for the HP -device and other workstation devices - please refer the Cisco profiling accuracy -http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-30-ISE_Profiling_Design_Guide.pdf 3. still profiling accuracy fails - create customised profiling policy for HP-workstation or 4. create autz policy based on 802.1x attribute and with the domain group-(users AD group) without any device profile.to overcome profiling issue,. Cheers, Pradeep *** Rate if it helps

Pradeep S.R. · ‎06-13-2016

Hi Jack, Please let me know which version of ISE you are using and do u created the ISE Authz policies based on device profile or only 802.1x attribute? 1. by looking at the screenshot I can see device is getting profiled as cisco device ? 2. u need to compare the policy for working device and non- working HP PC- as in screenshot shows device sending the authentication- MAB(Mac address bypass) method. 3. yes - by default radius suppress setting is enabled in ISE- you can verify in settings->protocol->Radius protocols-settings -it only applies to devices if Reject Request After Detection is enabled and policy will be in effect till the request rejection interval time specified- share the details- will suggest the fix. Cheers, Pradeep *** Rate if it helps

Pradeep S.R. · ‎09-04-2012

Hi.. Hi Can anyone explain how IPS works in ASA firewalls and SSL/IPSEC VPN configurations?

Pradeep S.R. · ‎09-03-2012

Thank you Karthik...

Pradeep S.R. · ‎09-03-2012

Thank you.. Jcarvaja..

Pradeep S.R. · ‎08-31-2012

Hi Tanoop, U need to enable intervlan routing for the Server to communicate with that. Refer Below Docs as well... http://networkcity.blogspot.in/2010/01/configuring-inter-vlan-routing-and-dhcp.html?spref=fb http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a008019e74e.shtml Regards Pradeep Poojari Please rate if it Serves you

Date Registered	‎05-16-2012 12:19 AM
Date Last Visited	‎09-07-2018 12:03 AM
Total Messages Posted	23
Total Helpful Votes Received	2

Re: Site to site VPN redundancy with sa...

Site to site VPN redundancy with same s...

Cisco ISE 300-208 exam does it renew Ci...

Hi Roman,

Hi Marc,

Hi Jack,

Hi Jack,

Hi Jack,

Hi Jack,

Hi jack,

Hi Jack,

Hi Can anyone explain how IPS works in ...

Re: How ASA holds and inspect the UDP p...

Re: How ASA holds and inspect the UDP p...

How do I get my VLAN 40 to communicated...