Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Parag Mahajan
08-15-2019
Stats
Member since
05-13-2012
79
Posts
34
Helpful
5
Solutions
Created by
Parag Mahajan
in Security Documents
in Security Documents
06-26-2018
05:25 AM
06-26-2018
05:25 AM
Very detailed Guide. Thanks Hari for the effort!!!
... View more
Created by
Parag Mahajan
in Security Documents
in Security Documents
02-08-2018
02:14 AM
02-08-2018
02:14 AM
@Chyps : Thanks for the reply. I am working with CSCO12878976 , replying on his behalf . We have radius reauth configured for 6hrs. LB Persistence timeout is set to 8 hrs. interim accounting update is set to 2 days. Looking at above number ideally persistence should get refreshed after every 6 hrs for same MAC addresses. But its not working as expected. We tried to reach to F5 as we said earlier , they refused to help. Do you have any pointers how to resolve this issue. Appreciate your help.
... View more
Created by
Parag Mahajan
in VPN and AnyConnect
in VPN and AnyConnect
11-18-2014
04:22 AM
11-18-2014
04:22 AM
Hi All, I am trying to assign DAP attribute to VPN users (Anyconnect 3.0 +) who fulfill some registry condition. While configuring DAP policy , while selecting registry condition it is giving error as "cisco secure desktop (CSD) is not enabled , CSD must be enabled to configure registry endpoint attribute" . But as I percevied from link , to check registry attribute "host scan" which is integrated in anyconnect 3.0 module will be responsible . So why it is asking me to enable CSD ? Is CSD really needed to check registry attribute even if we are using anyconenct 3.0 + ? Any pointer
... View more
- Tags:
- #asa #VPN #dap
Labels:
03-10-2014
02:39 PM
I do not get exactly what are you looking for.. But still The two kind of access you are anticipating can be achived by either way Chage of VLAN : as explained by you... you need to create two differnent authorization policies as per users belongs to (AD )group <e.g. employee or guest..> .. dACL : You can push downloadable Acl to switch as per user membership to AD. Let me know if you need help from design or configuration point of view...
... View more
Created by
Parag Mahajan
in Policy and Access
in Policy and Access
03-07-2014
08:56 AM
03-07-2014
08:56 AM
Hi , Its worth checking SSID setting in - > advanced - >Enable Session Timeout . Hope the value configured around 1800 ..
... View more
Created by
Parag Mahajan
in Policy and Access
in Policy and Access
12-16-2013
03:58 AM
12-16-2013
03:58 AM
Thanks Edward
... View more
Created by
Parag Mahajan
in Policy and Access
in Policy and Access
12-06-2013
03:22 AM
12-06-2013
03:22 AM
Hi All, We are testing Anyconnect VPN users tring to connect using certificate. ASA is validating/ authenticating user based on cert and for authorization it is requesting Radius server(ISE). Currently ASA is sending Ip address of VPN client in "calling station ID" .We want ASA to send MAC address of Anyconnect VPN client to radius server in 'calling station ID' radius attribute. Is it possible to achieve this. Any workround ?
... View more
Labels:
Created by
Parag Mahajan
in Policy and Access
in Policy and Access
11-20-2013
02:50 AM
11-20-2013
02:50 AM
Thanks both of you. But I believe some workaround should be there to resolve. Can not wait to release ISE 1.3 . Till that time only way I could see is to rebuild the ISE instance. What do you say ?
... View more
Created by
Parag Mahajan
in Policy and Access
in Policy and Access
11-13-2013
04:14 AM
11-13-2013
04:14 AM
In test lab, using ISE 1.2. trying to authenticate wireless endpoint from WLC 2500 with code 7.2.103 . But when wireless endpoint trying to connect to 802.1X SSID receiving ISE logs showing following error. 5441 Endpoint started new EAP session while the packet of previous EAP session is being processed. Dropping new session On endpoint its showing 'Connecting' status for long time... To resolve this disconnected endpoint from WLC, also tried to connect to SSID after waiting for considerable time- But No success. Never received error for prior to ISE 1.2. Any Workaround? Any bugs. Any pointer to resolve this,
... View more
Labels:
Created by
Parag Mahajan
in Policy and Access
in Policy and Access
03-08-2013
04:10 AM
03-08-2013
04:10 AM
Hi Mubashir, I believe there is way to pass the priviledge level attribute. In ISE create Authorization Profile as show with Advanced atribute : Cisco:cisco-av-pair= Shell:priv-lvl=5 See attached screenshot call/refere this auth profile in Authorization Rule for Device access. In Network Device (Switch) for which access need to be configured ... Allow some set of command for privilege level 5 It should work.. If not getting expected result " Debug radius " on switch , see if ise is returrning Cisco AV pair= 5 after successful authentication.
... View more
Created by
Parag Mahajan
in Identity Services Engine (ISE)
07-16-2019
07-16-2019
@Nidhi : Thanks for conformation. again Verifing the same, So in ISE 2.4
distributed deployment, if ...
07-14-2019
your approach is correct. We also use same solution. temporarry access -
DNS, DHCP and ISE access
Created by
Parag Mahajan
in Identity Services Engine (ISE)
07-11-2019
07-11-2019
@Nidhi : Thanks for reply. But the link does not mention information
about number of concurrent sess...
Created by
Parag Mahajan
in Identity Services Engine (ISE)
07-10-2019
07-10-2019
Curiosly waiting for response.
Created by
Parag Mahajan
in Identity Services Engine (ISE)
07-08-2019
07-08-2019
As per the below datasheet
https://www.cisco.com/c/en/us/products/collateral/security/identity-servi...
06-01-2019
Just to add more, dacl has to be delievered as a part of single radius
accounting packet. As per rad...
Created by
Parag Mahajan
in Identity Services Engine (ISE)
04-13-2019
04-13-2019
SNMPv3 is not supppoted for Port config status report/ Network device
session report. Same has been ...
Created by
Parag Mahajan
in Identity Services Engine (ISE)
04-13-2019
04-13-2019
As per my understanding, MDM attribute is not available in profiling.
Created by
Parag Mahajan
in Identity Services Engine (ISE)
03-03-2019
03-03-2019
It is fixed in 2.4 patch6. It is getting tracked by CSCvm66696.
Created by
Parag Mahajan
in Identity Services Engine (ISE)
03-03-2019
03-03-2019
ISE ERS API does allow you to modify , create, delete hotspot portal
also access code can also be mo...
Created by
Parag Mahajan
in Identity Services Engine (ISE)
03-01-2019
03-01-2019
ISE 2.4 version is not supported on 3415 appliances.
Created by
Parag Mahajan
in Identity Services Engine (ISE)
01-08-2019
01-08-2019
In Authz Policy create rule on top as below MDM·MDMServerReachable
equals unreachable && AD: Externa...
Created by
Parag Mahajan
in Identity Services Engine (ISE)
01-08-2019
01-08-2019
Assuming that you have sorted out domain issues means got the cert from
publicCA. You can assig new ...
Created by
Parag Mahajan
in Identity Services Engine (ISE)
12-20-2018
12-20-2018
I have faced similar challenge for one of my customer. We have filed
below defect. CSCve05681 ERS Ge...
Public Statistics
| Date Registered | 05-13-2012 11:17 PM |
| Date Last Visited | 08-15-2019 11:36 PM |
| Total Messages Posted | 79 |
| Total Helpful Votes Received | 34 |
.jpg "VIP Engager"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 1 | |
| 1 |
