I'm not sure if this possible so if someone could help me that would be good.   We want to lock down our ISE policies so that unauthenticated machines get very limited access. However our desktop support team still wants to be able to build PCs at desks.   To do this they need access to loads of AD and SCCM servers, which the unauth acl will not allow them to access.   They are happy to add the endpoints manually into a specific group. But may forget to take them out after the machine has been built - is it possible to automatically remove any endpoint in a specified group on a scheduled basis? ... View more

We are shortly upgrading some of our inter-site links from 1Gb to 10Gb. As part of that work I will be changing the reference bandwidth on the core switches from 2Gb to 100Gb (giving a bit of headroom over the 10GB circuits as we already have some 20GB links). This is nice and easy all I have to do is enter the OSPF process and type auto-cost reference-bandwidth 100 Gbps. However we also have a large number of ASA firewalls running as part of OSPF - these all seem to be using a reference bandwidth of 100Mbps. as you can see in the screen extract below PEG-VFW01/peg-dfg-vfw01# sh ospf Routing Process "ospf 1" with ID 172.31.22.1 Start time: 17:03:37.230, Time elapsed: 6w1d (lines omitted) Reference bandwidth unit is 100 mbps How can I change the reference bandwidth to 100Gbps. Looking at the cisco documentation it appears you can do that using OSPF V3 but as I am not running IPV6 I don't want or need to enable that. Any suggestions welcome? Thanks GIles ... View more

We have just installed a set of 5585 firewalls running multiple virtual contexts. What I want to do is to back up the system context (the other contexts are managed separately) Adding the device in Prime works perfectly and the configuration is backed up - almost. What doesn't appear to be backed up are the security keys. I think either the system is hiding them or it is not running the more running-config command to export the keys. Any suggestions on how to get this to work. Thanks Giles ... View more

I have a strange problem with profiling Cisco IP Phones. We have various types of phones 9630, 4622 and 4621s which work fine and 1608 and 4610s which won't profile properly. Looking at the DHCP request I think I have found the issue. 9630 Phone Frame 378: 590 bytes on wire (4720 bits), 590 bytes captured (4720 bits)     Encapsulation type: Ethernet (1)     Arrival Time: Feb 26, 2016 14:52:39.019126000 GMT Standard Time     [Time shift for this packet: 0.000000000 seconds]     Epoch Time: 1456498359.019126000 seconds     [Time delta from previous captured frame: 0.359769000 seconds]     [Time delta from previous displayed frame: 0.000000000 seconds]     [Time since reference or first frame: 47.424667000 seconds]     Frame Number: 378     Frame Length: 590 bytes (4720 bits)     Capture Length: 590 bytes (4720 bits)     [Frame is marked: False]     [Frame is ignored: False]     [Protocols in frame: eth:ethertype:ip:udp:bootp]     [Coloring Rule Name: UDP]     [Coloring Rule String: udp] Ethernet II, Src: TenovisK_b1:93:e3 (00:07:3b:b1:93:e3), Dst: Broadcast (ff:ff:ff:ff:ff:ff)     Destination: Broadcast (ff:ff:ff:ff:ff:ff)         Address: Broadcast (ff:ff:ff:ff:ff:ff)         .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)         .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)     Source: TenovisK_b1:93:e3 (00:07:3b:b1:93:e3)         Address: TenovisK_b1:93:e3 (00:07:3b:b1:93:e3)         .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)         .... ...0 .... .... .... .... = IG bit: Individual address (unicast)     Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255     0100 .... = Version: 4     .... 0101 = Header Length: 20 bytes     Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)         0000 00.. = Differentiated Services Codepoint: Default (0)         .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)     Total Length: 576     Identification: 0xf11a (61722)     Flags: 0x02 (Don't Fragment)         0... .... = Reserved bit: Not set         .1.. .... = Don't fragment: Set         ..0. .... = More fragments: Not set     Fragment offset: 0     Time to live: 32     Protocol: UDP (17)     Header checksum: 0x6793 [validation disabled]         [Good: False]         [Bad: False]     Source: 0.0.0.0     Destination: 255.255.255.255     [Source GeoIP: Unknown]     [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: 68 (68), Dst Port: 67 (67)     Source Port: 68     Destination Port: 67     Length: 556     Checksum: 0x8507 [validation disabled]         [Good Checksum: False]         [Bad Checksum: False]     [Stream index: 35] Bootstrap Protocol (Discover)     Message type: Boot Request (1)     Hardware type: Ethernet (0x01)     Hardware address length: 6     Hops: 0     Transaction ID: 0x3065de80     Seconds elapsed: 0     Bootp flags: 0x0000 (Unicast)         0... .... .... .... = Broadcast flag: Unicast         .000 0000 0000 0000 = Reserved flags: 0x0000     Client IP address: 0.0.0.0     Your (client) IP address: 0.0.0.0     Next server IP address: 0.0.0.0     Relay agent IP address: 0.0.0.0     Client MAC address: TenovisK_b1:93:e3 (00:07:3b:b1:93:e3)     Client hardware address padding: 00000000000000000000     Server host name not given     Boot file name not given     Magic cookie: DHCP     Option: (53) DHCP Message Type (Discover)         Length: 1         DHCP: Discover (1)     Option: (57) Maximum DHCP Message Size         Length: 2         Maximum DHCP Message Size: 1000     Option: (55) Parameter Request List         Length: 7         Parameter Request List Item: (1) Subnet Mask         Parameter Request List Item: (28) Broadcast Address         Parameter Request List Item: (3) Router         Parameter Request List Item: (6) Domain Name Server         Parameter Request List Item: (15) Domain Name         Parameter Request List Item: (42) Network Time Protocol Servers         Parameter Request List Item: (242) Private/Avaya IP Telephone     Option: (12) Host Name         Length: 9         Host Name: AVTB193E3     Option: (60) Vendor class identifier         Length: 13         Vendor class identifier: ccp.avaya.com     Option: (255) End         Option End: 255     Padding: 000000000000000000000000000000000000000000000000... 1608 phone Frame 2: 1038 bytes on wire (8304 bits), 1038 bytes captured (8304 bits)     Encapsulation type: Ethernet (1)     Arrival Time: Feb 26, 2016 14:33:46.926553000 GMT Standard Time     [Time shift for this packet: 0.000000000 seconds]     Epoch Time: 1456497226.926553000 seconds     [Time delta from previous captured frame: 28.158921000 seconds]     [Time delta from previous displayed frame: 28.158921000 seconds]     [Time since reference or first frame: 28.158921000 seconds]     Frame Number: 2     Frame Length: 1038 bytes (8304 bits)     Capture Length: 1038 bytes (8304 bits)     [Frame is marked: False]     [Frame is ignored: False]     [Protocols in frame: eth:ethertype:ip:udp:bootp]     [Coloring Rule Name: UDP]     [Coloring Rule String: udp] Ethernet II, Src: AvayaInc_bc:5b:c0 (38:bb:3c:bc:5b:c0), Dst: Broadcast (ff:ff:ff:ff:ff:ff)     Destination: Broadcast (ff:ff:ff:ff:ff:ff)         Address: Broadcast (ff:ff:ff:ff:ff:ff)         .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)         .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)     Source: AvayaInc_bc:5b:c0 (38:bb:3c:bc:5b:c0)         Address: AvayaInc_bc:5b:c0 (38:bb:3c:bc:5b:c0)         .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)         .... ...0 .... .... .... .... = IG bit: Individual address (unicast)     Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255     0100 .... = Version: 4     .... 0101 = Header Length: 20 bytes     Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)         0000 00.. = Differentiated Services Codepoint: Default (0)         .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)     Total Length: 1024     Identification: 0x6746 (26438)     Flags: 0x02 (Don't Fragment)         0... .... = Reserved bit: Not set         .1.. .... = Don't fragment: Set         ..0. .... = More fragments: Not set     Fragment offset: 0     Time to live: 32     Protocol: UDP (17)     Header checksum: 0xefa7 [validation disabled]         [Good: False]         [Bad: False]     Source: 0.0.0.0     Destination: 255.255.255.255     [Source GeoIP: Unknown]     [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: 68 (68), Dst Port: 67 (67)     Source Port: 68     Destination Port: 67     Length: 1004     Checksum: 0xa725 [validation disabled]         [Good Checksum: False]         [Bad Checksum: False]     [Stream index: 0] Bootstrap Protocol (Discover)     Message type: Boot Request (1)     Hardware type: Ethernet (0x01)     Hardware address length: 6     Hops: 0     Transaction ID: 0x2ec969f0     Seconds elapsed: 0     Bootp flags: 0x0000 (Unicast)         0... .... .... .... = Broadcast flag: Unicast         .000 0000 0000 0000 = Reserved flags: 0x0000     Client IP address: 0.0.0.0     Your (client) IP address: 0.0.0.0     Next server IP address: 0.0.0.0     Relay agent IP address: 0.0.0.0     Client MAC address: AvayaInc_bc:5b:c0 (38:bb:3c:bc:5b:c0)     Client hardware address padding: 00000000000000000000     Server host name not given     Boot file name not given     Magic cookie: DHCP     Option: (53) DHCP Message Type (Discover)         Length: 1         DHCP: Discover (1)     Option: (57) Maximum DHCP Message Size         Length: 2         Maximum DHCP Message Size: 576     Option: (55) Parameter Request List         Length: 7         Parameter Request List Item: (1) Subnet Mask         Parameter Request List Item: (28) Broadcast Address         Parameter Request List Item: (3) Router         Parameter Request List Item: (6) Domain Name Server         Parameter Request List Item: (15) Domain Name         Parameter Request List Item: (42) Network Time Protocol Servers         Parameter Request List Item: (242) Private/Avaya IP Telephone     Option: (12) Host Name         Length: 9         Host Name: AVXBC5BC0     Option: (255) End         Option End: 255     Padding: 000000000000000000000000000000000000000000000000... Looking at these two it appears the 9630 send a vendor class identifies (60) as ccp.avaya.com. The 1608 doesn't. The ISE Profiling rule used the VCI to identify as a Avaya-IP-Phone. Now to get round this I could change my authentication rule to use the Avaya-Device profiling group but this seems a little bit wrong. I don't expect anything other than IP phones from Avaya but..... Any suggestions on how best to do the profiling. I have attached the wireshark captures to this message as well. Thanks Giles ... View more

We are trying to deploy anyconnect nam from a batch file. We have the following components in the source folder anyconnect-dart-win-3.1.10010-k9.msi anyconnect-nam-win-3.1.10010-k9.msi anyconnect-win-3.1.10010-pre-deploy-k9.msi There is also a profiles directory which contains 5 sub folders and a configuration.xml file in the NAM folder.   The install is run off an install.bat file with the contents as below. msiexec /i anyconnect-win-3.1.10010-pre-deploy-k9.msi /norestart /passive PRE_DEPLOY_DISABLE_VPN=1 msiexec /i anyconnect-dart-win-3.1.10010-k9.msi /norestart /passive msiexec /i anyconnect-nam-win-3.1.10010-k9.msi /norestart /passive The rather big problem is that once the install completed it kills the network card until the machine has been restarted (or the current user logs off and back on again). Not really ideal when you want to roll out to 2000+ workstations. Can anyone suggest where we are going wrong?   Thanks   ... View more

I have a rather large problem that is causing grief with an ISE rollout. The workstations that we have are 99% running windows 7. We have administrators that want to be able to log in via remote desktop when the users aren't present (i.e. after a Wake on LAN request) and troubleshoot issues. When they do this windows does not treat the remote desktop session as an interactive login and hence the computer does not jump from the domain to the user policy.   I am after suggestions on how we can get this working. Is it possible for the Anyconnect supplicant to treat the remote login as an interactive login (we aren't using AnyConnect as a supplicant at the moment)? Or is there another way - I can't believe that we there isn't a known function for bypassing this issue. Alternatively I could just move back to computer authentication and give the computer account full access.   Thanks in advance   Giles ... View more