Hi Everyone I have a Design-Question regarding RBAC (trying to avoid CSCvb55884 - related to the Default Network device Groups): Does anyone use a Design that actually works and which fulfils the following needs: 1. Having ca 20 Sites with Local Admins - which should be able to Add, Change, Delete "their" local-site NAD's in ISE 2. The Site admins should not have access to view NAD-Configuration from other Sites 3. There are Global Technology-Administrator-Groups which should be able to manage only specific Devices Types which are located Centrally and Locally on different sites within ISE (like central and decentral Firewalls, Switching/Routing, Proxy and so on) In short : The ISE RBAC-requirements are for the data access: - ISE Admin-Group Access: Condition: if NAD-Location AND NAD-Type = then Permit access The testing ive been doing until now has shown a ISE RBAC logic as following: - ISE Admin-Group Access: Condition: if NAD-Location OR NAD-Type = then Permit access (and this does not provide enough restricted access enough - and when designing one "Network device Tree" with both "conditions" within that tree - it does not scale = i get hundred / thousands of Groups reflecting each location with all the different device-types within it.. Anyone else knowing how to solve this limitation? ... View more

Hi   Are there any validated, detaild information about the "VeriSign Class 3 Secure Server CA – G3"  Certificate? As @Jason Kunst  mentioned,  It is "possible" that following services can be internally using this trust certificate. How should customers and partners intepret this statement "possible"? - Does not Cisco know if what exactly the different Trusted Certificates within ISE is used for- related to  PxGrid, TC-NAC and so on? - or Is this something customers them selves can configure to use explicit for TC-NAC? - "How would this typically be done"   Somehow i intepret the answer as: "we have no clue what we are doing - but disable it and see what happends..."         ... View more

Hi "Once successfully added, create a user in Stealthwatch and tell Stealthwatch to use this newly added Authentication service for that user." When authentication 10 users or more with tacacs+, do you have to create each and every user in Stealthwatch too? Is there no Tacacs / Radius attributes the Radius (ISE) server can send back to Stealthwatch SMC to automaticaly assign the Role ? Regards Jarle ... View more

Hi Craig Since the CoA is originating from the Management interface of the ISE, - what is the reccomended configuration on IOS Switches?  I guess this is no big issue just adding the ise mgmt interface to the "aaa server radius dynamic-author"'s - what is reccomended for WLC? How can we ensure enabeling ISE-NAC but ensure that Radius requests are only sendt to the "ISE Radius interface" but the CoA allowed from the Mgmt interface? - what is reccomended for ASA? and other Cisco Products? DOes all products understand the difference between Radius request and recieving the radius CoA? and is it possible to configure this induvidually on all cisco products?   When adding the complexity of Tustsec? as some CoA are sent from PAN and not the PSN. To solve the issues addressed, I believe you (cisco) schould consider making it possible to select sourceinterfaces for different traffic related to ISE - I hardly believe the other workarounds will scale.   Best Regards Jarle Steffensen ... View more

I totally agree with johannes.luther. It is totally nonsense to only be able to profile devices which are granted access to the network. Are there any plans to change the behaviour of the device-sensor so that the device-sensor information also can be sent in the Radius Authentication request and not only Accounting packet from the NAS? I mean currently most switches are able to include VSA information in both AUTH as well as ACC Request... The workaround Cisco Propose (permitting all devices - and blocking network access using all or whatever) is definitely a NO-GO in environments which requires some kind of security. In these environments you abseloutel WOULD like to see the "Denied" access - in your logs. (this poposal is like permitting all packets through a firewall to avvoid all the "unnecessary logs" and then do policy based routing to a blackhole to all unwanted traffic that should be dropped.... - and how stupid is that.....) Best Regards Jarle ... View more

Hi Zohaib I've been facing the same error-messages and you, and found a pritty good "Step by Step guide" which helped me out: http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/identity-based-networking-service/116498-configure-cts-00.html Best Regards Jarle ... View more