About ffischer

ffischer · 03-19-2024

Hello, at a client we are running a large distributed deployment with 14 PSNsWe have enabled profiling to get visibilty whats on the network. If a device sensor on the switches recognizes and accounts an IP address on an port to the ISE,an automated ...

ffischer · 01-17-2024

Hello, consider a deployment where endpoints authenticate with EAP-TLS and ISE is using AD integration for retrieving and checking group membership of authenticating hosts. While registering new (or re-imaged) nodes to such ISE deploymentswe always r...

ffischer · 01-17-2024

Hello Cisco, we are running a Deployment with 18 ISE nodes; every node is joined to 4 Domainsresulting in totally 72 domain joins ! It is running for more than 5 years now without major issues. As you do not give any details,neither about the node no...

ffischer · 08-20-2019

Hi Cisco, Hi Community, One of my clients has exactly the same requirement. In our deployment we have 16 ISE Nodes in 7 Locations with several hundred Cisco switches as NADs.TACACS authentication, command authorization and command accounting is confi...

ffischer · 10-02-2018

I found the ASA RADIUS attribute CVPN3000/ASA/PIX7x-IE-proxy-lockdown 134 in the ISE Dictionary as well as listed here: https://community.cisco.com/t5/security-documents/ise-network-access-attributes/ta-p/3616253 If at all, what ASA ve...

ffischer · 03-22-2024

MHM, basically this would be a valid approach...Meanwile I set up another eval VM with 3.2 and while installing digged a bit through the profiling design guide - nmap probeParagraph "NMAP Probe Endpoint Scan" says:"Endpoints that match the Unknown pr...

ffischer · 03-21-2024

Cisco Identity Services Engine Installation Guide, Release 3.2 - CiscoWell, I know the Node Communnication matrix, the ports and and the table "Required Internet URLs" for specific features at the end of this page.But imho it is not totally clear d...

ffischer · 03-21-2024

Nope. The switch device sensor reports an MAC/IP to ISE.On ISE, this triggers a nmap scan to the IP reported.I could switch this automatism off completely, but this would lower our visibility what gets connected to the net.I'd like to have more flexi...

ffischer · 03-21-2024

Thanks for your comments, Aref.We have serious reasons to use nmap for profiling in addition to the device sensor.we still have some older switch models in the network that are due to be replaced, but budget & ressources are not unlimited,so this tak...

ffischer · 03-21-2024

So you really suggest running 3.3 in a productive environment with several 10.000 endpoints high network resilience and availability requirements ?I'd say: maybe once in the future when there will be a 3.3p5 or p6...Another idea I had just while writ...

Member Since	‎11-15-2001 08:50 AM
Date Last Visited	‎03-27-2024 12:16 AM
Posts	60
Total Helpful Votes Received	27

User Statistics

User Activity

ISE - control NMAP - subnet inclusion ?

ISE: possibility to temporarily disable answering RADIUS Requests

CSCvu77718 - details ACTIVE_DIRECTORY_DIAGNOSTIC_TOOL_ISSUES_FOUND

CSCvm95153 - Collection Filters for TACACS needs to be more granular

ASA RADIUS attribute CVPN3000/ASA/PIX7x-IE-proxy-lockdown - supported ? Type ? Valid Values ?

Re: ISE - control NMAP - subnet inclusion ?

Re: ISE - control NMAP - subnet inclusion ?

Re: ISE - control NMAP - subnet inclusion ?

Re: ISE - control NMAP - subnet inclusion ?

Re: ISE - control NMAP - subnet inclusion ?