Hi, I've Cisco ISE 2.2.0.470 patch 1. Every time that a user tries to access the network via MAB Authentication, authentication fails. Failure reason is "22017 Selected Identity Source is DenyAccess". The resolution is Select a different identity source. The identity store is in fact DenyAccess while previously the identity store of my users was Guest_Users. How could I select a different identity store? How could I change DenyAccess identity store? Is it possible? Thanks Antonio ... View more

Hi, I've a Cisco 3850 with WLC functionalities enabled. I notice that there is a trunk between the switch and a capwap interface associated to an access-point. I also notice that all vlans configured on the switch are allowed on that trunk. How is it possible to permit only some specific vlans on that trunk? How is it possible to tune the native vlan on that trunk? Thanks Antonio ... View more

Hi, I have two ASA5508 with firepower services configured in failover mode. I would activate VPN Remote Site services and I would to use Cisco Anyconnect tool for VPN with SSL protocol. Actually I haven't licenses to use Anyconnect with SSL protocol. VPN users could be maximum 3. VPN simultaneous users could be maximum 2. Which is the license code to buy? Do I need to buy a license for each ASA? Could anyone support me to define licenses that I have to buy? Thanks ... View more

Hi, I've a Cisco ISE 2.1 with patch 1 installed and Cisco SG500X as switches. I've configured Radius-Vlan Assignment Policy with Central Web Authentication redirection. I've configured DHCP and DNS services on ISE for guest users. DHCP lease time is 300 seconds. Guest portal on ISE is configured on the same network where DHCP/DNS services are active. This network is completely isolated from other networks. When there is a new guest on the network, the switch begins a RADIUS communication to ISE. ISE sends the guest vlan to the switch for the new user. In the authorization policy there is also the information about URL Redirection. As soon as the MAC Address is authorized, guest PC begins a DHCP request and ISE offers ip address on Guest Vlan. After guest PC has received ip address, guest PC begins DNS resolution and Cisco ISE replies with its address. The flow described above works perfectly. The problem is that web redirection works randomly in a right manner. I notice that URL Redirection works in various scenarios: - DHCP/DNS Sinkhole as described before (scenario of URL static redirection) - dynamic redirection with ACL - without RADIUS authentication with switch port configured with VLAN static access configuration on guest VLAN. Often web redirection doesn't work but sometimes it works. When it works, it lasts for a very short period (some minutes). This situation occurs with different PCs. Today afternoon works only once (from 16.25 to 16.29) I attach my prrt-management.log. Every log before 15.48 is not valid because Guest Portal was active on a wrong interface so redirection could occur rightly. Then I changed the interface and ISE began the reactivation process. Valid logs are from 16.01. I don't understand where is the problem. It is very strange that also without radius protocol, it works randomly. Is there anyone who can help me? Thanks ... View more

Hi, I have two SG500x-24 ports with 1.4.5.02 firmware. Switches are configured in L2 mode with Advanced Hybrid Stacking. If I have a port in multiple-sessions mode, is it possible to use features like Guest Vlan or Radius - Vlan Assignment with these switches on that port? Thanks Antonio ... View more

Hi, I have a switch Cisco SG500X with 1.4.5.02 firmware. I would to authenticate my users through ISE guest portal but I don't receive the redirection to Ise guest portal. I try two methods for redirection: - dynamic redirect url - DNS sinkhole functionality of Cisco Ise 2.1 I use the steps described in this link as a guide for configuration on redirection for the last method: http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-21/200604-Configure-Third-Party-NAD-Redirection-on.html In both situation I always receive these logs on my Cisco SG500X: %AAAEAP-W-RADIUSREPLY: Invalid attribute 65 ignored - tag should be 0 %AAAEAP-W-RADIUSREPLY: Invalid attribute 64 ignored - tag should be 0 I've activated RADIUS Vlan  Assignment, either with Reject or Static option. It seems like the switch doesn't support Change of Authorization (CoA) by Ise. Is it true? Does SG500X support CoA by Ise? Thanks Antonio ... View more

Hi, I've Cisco ISE 2.1 on virtual machine. I've setup a self registered guest portal and I've selected the "Automatically registered guest devices" on the section named Guest Devices Registration Settings. After the successful login of a guest, I notice that its mac address remains in the "unknown" endpoint group. I would to automatically register the device into "GuestEndpoint" group or into "Registered" group. Is it possible to automatically register guest devices without explicitly add mac address? In fact the manual registration is very unfeasible for a person who hasn't IT skills. Thanks Antonio ... View more

Hi, do you know if it is possible to authenticate Cisco Prime LMS users to ISE servers via RADIUS?   I have these versions: - ISE: 1.4.0.253 - Cisco Prime LMS: 4.2.5   If it is possible, how can I configure this authentication?   Thanks ... View more

Hi, I have some Cisco 7912 associated to a Call Manager 4: call control protocol is SCCP. Many parameters are fixed (IP address, TFTP server, Call Manager server,...) and I want to set then as dynamic, so I'm investigating how to change in an efficient manner these parameters. I want also to associate these phones to a new CUCM 9. The IP address of CUCM9 is different than CM4 one's. I notice that: - if I change only the DHCP flag to enable, a 7912 phone obatins the new TFTP server from DHCP configuration but it doesn't acquire the new Call Manager address so it registers on CM4; - if I delete configuration from the phone (by the option in network configuration), the phone  obtains both the new TFTP server from DHCP configuration and the new Call Manager address so it registers on CM9. Actually there isn't any password for 7912 phones so it is not possible to change network configuration from web page. I know that is possible to set a password for 7912 phone by a file loaded on a TFTP server. How could I upload by TFTP a configuration file from CM4 to 7912 phones with password? Thanks in advance Antonio ... View more

Hi, I have a Cisco 6524ME with IOS Advanced IP services version 12.2(33)SXH4. When the switch boots rightly, it reloads after 30 seconds that I can enter into CLI. During this short time I execute "show diagnostic events" and the output is the following. Diagnostic events (storage for 500 events, 1 events recorded) Event Type (ET): I - Info, W - Warning, E - Error Time Stamp         ET [Card] Event Message ------------------ -- ------ -------------------------------------------------- 06/17 16:44:48.760 E  [1]    TestLoopback Failed When I execute "show interface status", no output is reported. Every 3 or 4 reloads the system remains in rommon mode at switch processor level. Just previously entering in rommon mode, this message is reported: *** System received a Software forced crash *** signal= 0x17, code= 0x24, context= 0x430252b4   PC = 0x411ac108, SP = 0x41bfc388, RA = 0x408d73b4   Cause Reg = 0x00001020, Status Reg = 0x34008002 What is the problem? Is there any solution? Thanks in advance Antonio ... View more