Hi Luis, You don't need IGMP to be enabled for OTV unicast only mode. Probably you hit an order of operation issue. Did you configure the OTV adjacency-server unicast-only command underneath the OTV overlay interface before linking the join-interface to the overlay? Please try & advise.   Regards Vivek ... View more

Hi Ibrahim,   VxLAN BGP EVPN implementation solution uses BGP as a solution for the control plane not IS-IS. So VxLAN is basically an overlay protocol which does Bridging & Routing (again depends on hardware). The initial VxLAN implementations used VxLAN flood and Learn method which was no different than the Ethernet and there was a need for control-plane to learn the MAC addresses of the end hosts on the network. It was ideal to use BGP EVPN as EVPN (Sub address family of L2VPN) can carry L2 information.   Overall, BGP was used to exchange Layer 2 information (MAC addresses) of the endpoint. I don't know of any VxLAN implementations using IS-IS.   Regards Vivek ... View more

All, Just thought to update if someone is having a similar issue. A Cisco TAC case was raised for this to understand this issue. With Multi-Host mode, the controls applied to an endpoint seen first by the switch will have the same controls applied to all the underlying endpoints. In other words, the dACL is applied to the entire session. So in the above case, Flexconnect AP was the first MAC to be seen by the switch & hence was issued the AP dACL. Once the workstation connected to the AP, the same dACL was applied as well. This causes a problem. Solution is to allow all traffic on the dACL aka permit ip any any.   Regards Vivek ... View more

Hi Mats,   Just wondering if were successful in sorting out this issue? I'm running into a similar issue with our FlexConnect APs. We ran into two different sets of issues with our Multi-Host setup.   1) At few of our branches, we noticed that the first MAC learnt is a workstations MAC which is connected through the AP. Technically, AP must be the first MAC seen by switch. Don't know whats causing this.   2) The dACL we issued via ISE is restrictive and only allows certain ports. This seems to be breaking the connectivity of the workstations connected to the SSID. So, I'm suspecting if I have a missing port in my dACL or the dACL is applied to the entire session instead of applying it to the first MAC seen by the switch. By the same ACL we are issuing for our LWAPP APs & they seem to be working absolutely fine. Below is the dACL I have -   remark Allow Control and Provisioning of Wireless Access Points (CAPWAP) protocols. permit udp any any range 5246 5248 permit udp any range 5246 5248 any remark Allow Lightweight Access Point Protocol (LWAPP) permit udp any any range 12222 12224 permit udp any range 12222 12224 any remark Allow remote access (telnet and SSH) permit tcp any range 22 23 any remark Allow DHCP permit udp any any eq 67 permit udp any any eq 68 remark Allow DNS permit udp any any eq 53 remark Allow RDLP permit udp any any eq 6352 remark Allow NSI Protocol permit udp any any eq 37540 permit udp any any eq 37550 remark Allow TFTP permit udp any any eq 69 remark Allow FTP permit tcp any any eq 21 remark Allow Syslog permit udp any any eq 514 permit icmp any any deny ip any any   Do you reckon there could be few more ports for FlexConnects?   Regards Vivek         ... View more

Thanks for the detailed response. This question was raised after we were facing issues with our current configuration of order mab|dotx & priority dot1x|mab. We were running with the TAC case around this issue & now have been advised this is due to a bug. Again thanks a lot for responding. ... View more

Thank you for the detailed response. We have do have loads of MAB endpoints. Even I thought the case you mentioned would be the same. Until the 802.1x timeouts, the MAB-only capable endpoints will have to wait till the timeout period expires. So, technically apart from these issues you don't see any other challenge? Regards Vivek ... View more

I would see this against a design guidelines. Also, the manageability of this setup would be a nightmare as you would place individual PAN in each of your datacenter. In order to understand the endpoint state, you would need to determine which PAN you are suppose to login to view the status. There are couple of other issues which may arise 1) Synchronization of the Endpoint Database happens between ISE clusters. In your case, you would have a standalone ISE cluster per DC but your NAD is configured to talk to all the PSNs. In my view, this would create DB inconsistencies.  2) Assuming you would run DHCP profiling. You would be configuring all the PSN IPs as an IP helper address. Now, lets assume your DHCP profiling information was sent to a DC2, but the RADIUS information was to sent to DC1. There is no synchronization of this information between ISE nodes. This would cause issues. Best design would be to have 2 x Management nodes ; 2 x MnT & multiple PSNs per DC. You can use a load balancer to spread the RADIUS traffic between your DCs. ... View more

Hi, Endpoint seems to be getting authorization profile. But it is not being issued a "Voice" domain as the show auth session output shows up as DATA domain. This is the main reason why your IP phone doesn't acquire an IP address. Your dACL seems to be correct. Allowing all UDP & TCP 53 traffic. Cisco-Device is a very generic identification ISE is performing. Are you doing a DHCP profiling? Regards Vivek ... View more

Hi, Few questions 1) Is the workstation performing dot1x? 2) What is the version of ISE? 3) Is it a windows XP or 7 or some other version of OS? Regards Vivek ... View more

Hi, Based on the info provided, I believe ISE is unable to determine the IP Phone 1 as an "IP Phone" & hence not issuing the voice domain privileges back to the switchport. The IP phone is receiving a DATA domain. Now as you mentioned you have a PC connected through the Phone & its working fine. This may not be fully true. You have two MAC address on the single domain now. Your authentication mode is "Multi-Domain" which means one mac per domain (one from DATA ; one from voice) will be permitted. If you take a look at show ip access-list interface Gi 0/8 few times you would see the IP address being replaced back & forth based on your configuration (authentication violation replace). Kind of both fighting to stay on the network :) Can you please let me know what is ISE identifying the IP phone as from the auth logs? Also have a look at the authorization profile if you have checked the task named "Voice Domain Permission" on ISE.  Regards Vivek ... View more