Hi, Does anyone know if node groups are purely for policy server nodes behind a load balancer such as ACE.  If you have a pair of policy server nodes at a site with no load balancer, and both nodes configured in all NAS's can these be in a node group. Does anyone know if you can use a load balanced set of policy nodes with LWA and WLC.  There has to be affinity between the portal ISE and the AAA ISE configured in the WLC, these would be two different sessions one Radius and one HTTP, so the ACE would not be able to distinguish. Thanks. Gary ... View more

Hi, We are testing ISE in a wired environment. We have set up two authorization profiles called AD_Machine and AD_User as recommned in Trustsec 2.0 doc.  The AD_Machine policy has a condition set on it to look at the AD External Group AD Machines, likewise the AD_User has a condition to look at AD External Group AD Users.  At the end of the authorization policy list we have the default policy, this is set to WEBAUTH authorization profile. What we see is machine auth is granted by the WEBAUTH policy as this is catch all.  If I disable WEBAUTH it picks AD_Machine, also if I enable WEBAUTH and remove the AD External Group AD Machines condition it also selects the correct policy. There seems to be some kind of timing issue when authorizing against an external DB. Any ideas? Thanks. Gary ... View more

If we remove a EIGRP address family and add it back into the configuration the eigrp peers no longer establish. Eventually IP connectivty fails as well. Has anyone seen this before? Thanks ... View more

Hi, Anyone know the answers to these question:- Do Cisco have a recommended deployment methods for users currently running pre-shared keys and SDI to certificates and AD authentication.  This must minimize user intervention.  I don’t think SCEP will be any good, it has to be done by AD policy to install certificates and set the correct connection profile within the client, ie edit the pcf file and use microsoft certifcate stores.  Each ID certificate will be unique in terms of CN, and serial number. How do we prevent the ID certificate from becoming exportable on the VPN client, we have the template within MS CA set to non exportable, but the certificates remains exportable.  The certs carry the private key hence why we can use them on other machines by exporting and importing.  I don’t think the CA/RA certs are exportable because the private keys are not there, we get a error 36 when we do this. How secure is the Cisco certificate store on the PC, can it be compromised and the certificates copied elsewhere.  This is using the Cisco store rather than the MS store. It seems to me its OS dependant, but still open to abuse.  It looks like there are 3 stores, Cisco, MS, and MS User (per user account on machine). Thanks Gary ... View more

Hi, Anyone know why the ID certificate is missing when the system time reverts back to 1999 after being powered off for a day or so. I am guessing its because the certificate has a start and end valid date, but whats the fix to prevent this. Is it possible to backup the cetificates, maybe via FTP? Thanks Gary ... View more

Hi, Does anyone know what "persistence rebalance strict" on the HTTP parameter on an ACE will do. I understand it load balances a tcp connection matching a layer 7 class map to different servers, as oppsosed to "persistence rebalance" load balances to the same server matching a layer 7 class map. Thanks ... View more

Hi, Has anyone got OWA (exchange 2007)working with WebVPN on a VPN3K. I have had partial success, the customer can login, but some of the links are broken, page cannot be displayed. They are running the latest software. I know support finished at 2003. Thanks Gary ... View more