Hello, Please check CSCvi84511 Problem appeared after upgrade from 8.5.0.110 to 8.5.0.120 Regards ... View more

Hello, I've set a few ports with that configuration and will observe the results. Thank you ... View more

Hello David,   Here's the complete output   #show platform qos queue stat gig 6/0/24 DATA Port:6 Enqueue Counters ------------------------------- Queue Buffers Enqueue-TH0 Enqueue-TH1 Enqueue-TH2 ----- ------- ----------- ----------- -----------     0       0           0           0 33984241356     1       0           0           0           0     2       0           0           0           0     3       0           0           0           0     4       0           0           0           0     5       0           0           0           0     6       0           0           0           0     7       0           0           0           0 DATA Port:6 Drop Counters ------------------------------- Queue Drop-TH0    Drop-TH1    Drop-TH2    SBufDrop    QebDrop ----- ----------- ----------- ----------- ----------- -----------     0           0           0     1569626           0           0     1           0           0           0           0           0     2           0           0           0           0           0     3           0           0           0           0           0     4           0           0           0           0           0     5           0           0           0           0           0     6           0           0           0           0           0     7           0           0           0           0           0  AQM Broadcast Early WTD COUNTERS(In terms of Bytes) --------------------------------------------------   PORT TYPE          ENQUEUE             DROP --------------------------------------------------  UPLINK PORT-0        N/A               0  UPLINK PORT-1        N/A               0  UPLINK PORT-2        N/A               0  UPLINK PORT-3        N/A               0  NETWORK PORTS           0                  0  RCP PORTS               0                  0  CPU PORT                0                  0 Note: Queuing stats are in bytes     #show platform qos queue config gig 6/0/24 DATA Port:6 GPN:956 AFD:Disabled QoSMap:1 HW Queues: 48 - 55   DrainFast:Disabled PortSoftStart:2 - 10000 ----------------------------------------------------------   DTS Hardmax   Softmax  PortSMin GlblSMin  PortStEnd   --- --------  -------- -------- --------- ---------  0   1  4     0  8 10000  7   800   3   300   2 10000  1   1  4     0  5     0  5     0   0     0   2 10000  2   1  4     0  5     0  5     0   0     0   2 10000  3   1  4     0  5     0  5     0   0     0   2 10000  4   1  4     0  5     0  5     0   0     0   2 10000  5   1  4     0  5     0  5     0   0     0   2 10000  6   1  4     0  5     0  5     0   0     0   2 10000  7   1  4     0  5     0  5     0   0     0   2 10000  Priority   Shaped/shared   weight  shaping_step  --------   ------------   ------  ------------  0      7     Shared            50           0  1      0     Shared         10000         128  2      0     Shared         10000         118  3      0     Shared         10000           0  4      0     Shared         10000         144  5      0     Shared         10000           0  6      0     Shared         10000         128  7      0     Shared         10000           0    Weight0 Max_Th0 Min_Th0 Weigth1 Max_Th1 Min_Th1 Weight2 Max_Th2 Min_Th2    ------- -------  ------  ------  ------  ------  ------  ------ ------  0      0    7968       0       0    8906       0       0   10000       0  1      0       0       0       0       0       0       0       0       0  2      0       0       0       0       0       0       0       0       0  3      0       0       0       0       0       0       0       0       0  4      0       0       0       0       0       0       0       0       0  5      0       0       0       0       0       0       0       0       0  6      0       0       0       0       0       0       0       0       0  7      0       0       0       0       0       0       0       0       0 ... View more

Hello, On the C3850 platform QoS cannot be disabled. https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3850-series-switches/118629-technote-qos-00.html#anc14 I don't get why a C3850 would drop traffic with such a small load ... View more

Hello, Thank you for your answers   David: I forgot to mention that I already applied qos queue-softmax-multiplier 1200   Leo: I have read this bug but it looks like a comsmetic bug whereas the drops seems to be real. However I plan to upgrade to 3.06.07b The WLC and AP are in version 8.5.110.0   #sh interface Gi6/0/24 contr GigabitEthernet6/0/24 is up, line protocol is up (connected)   Hardware is Gigabit Ethernet, address is 50f7.2778.1888 (bia 50f7.2778.1888)   MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive set (10 sec)   Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX   input flow-control is off, output flow-control is unsupported   ARP type: ARPA, ARP Timeout 04:00:00   Last input 00:00:15, output never, output hang never   Last clearing of "show interface" counters 7w1d   Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 1569626   Queueing strategy: Class-based queueing   Output queue: 0/40 (size/max)   5 minute input rate 1000 bits/sec, 1 packets/sec   5 minute output rate 1000 bits/sec, 1 packets/sec      43816153 packets input, 17313295590 bytes, 0 no buffer      Received 364800 broadcasts (364800 multicasts)      0 runts, 0 giants, 0 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored      0 watchdog, 364800 multicast, 0 pause input      0 input packets with dribble condition detected      50776790 packets output, 33407289779 bytes, 0 underruns      1569626 output errors, 0 collisions, 0 interface resets      0 unknown protocol drops      0 babbles, 0 late collision, 0 deferred      0 lost carrier, 0 no carrier, 0 pause output      0 output buffer failures, 0 output buffers swapped out Transmit                  GigabitEthernet6/0/24                 Receive   51170201466 Total bytes                 17510621725 Total bytes      69965681 Unicast frames                 44418999 Unicast frames   50400320917 Unicast bytes               17417333386 Unicast bytes       3305276 Multicast frames                 459664 Multicast frames     332310634 Multicast bytes                93286269 Multicast bytes       1974695 Broadcast frames                     10 Broadcast frames     437569915 Broadcast bytes                    2070 Broadcast bytes             0 System FCS error frames               0 IpgViolation frames             0 MacUnderrun frames                    0 MacOverrun frames             0 Pause frames                          0 Pause frames             0 Cos 0 Pause frames                    0 Cos 0 Pause frames             0 Cos 1 Pause frames                    0 Cos 1 Pause frames             0 Cos 2 Pause frames                    0 Cos 2 Pause frames             0 Cos 3 Pause frames                    0 Cos 3 Pause frames             0 Cos 4 Pause frames                    0 Cos 4 Pause frames             0 Cos 5 Pause frames                    0 Cos 5 Pause frames             0 Cos 6 Pause frames                    0 Cos 6 Pause frames             0 Cos 7 Pause frames                    0 Cos 7 Pause frames             0 Oam frames                            0 OamProcessed frames             0 Oam frames                            0 OamDropped frames       4080117 Minimum size frames                 115 Minimum size frames       4526128 65 to 127 byte frames           6739021 65 to 127 byte frames      32971017 128 to 255 byte frames         27367843 128 to 255 byte frames       3139495 256 to 511 byte frames          1944821 256 to 511 byte frames       1270966 512 to 1023 byte frames         1394208 512 to 1023 byte frames      29257929 1024 to 1518 byte frames        7432665 1024 to 1518 byte frames             0 1519 to 2047 byte frames              0 1519 to 2047 byte frames             0 2048 to 4095 byte frames              0 2048 to 4095 byte frames             0 4096 to 8191 byte frames              0 4096 to 8191 byte frames             0 8192 to 16383 byte frames             0 8192 to 16383 byte frames             0 16384 to 32767 byte frame             0 16384 to 32767 byte frame             0 > 32768 byte frames                   0 > 32768 byte frames             0 Late collision frames                 0 SymbolErr frames       1569626 Excess Defer frames                   0 Collision fragments             0 Good (1 coll) frames                  0 ValidUnderSize frames             0 Good (>1 coll) frames                 0 InvalidOverSize frames             0 Deferred frames                       0 ValidOverSize frames             0 Gold frames dropped                   0 FcsErr frames             0 Gold frames truncated             0 Gold frames successful             0 1 collision frames             0 2 collision frames             0 3 collision frames             0 4 collision frames             0 5 collision frames             0 6 collision frames             0 7 collision frames             0 8 collision frames             0 9 collision frames             0 10 collision frames             0 11 collision frames             0 12 collision frames             0 13 collision frames             0 14 collision frames             0 15 collision frames             0 Excess collision frames LAST UPDATE 710 msecs AGO     ... View more

Hello, Thank you for your reply. That document is very interesting. I've just read the chapter regarding the profiling with APs so far and got them working properly the way they showed it. However I'm not a big fan of MAB and profiling. Because ISE retieves CDP informations collected through SNMP. - You need CDP (or LLDP) enabled and you might not want that for different reasons (Security, Interoperability...) - A machine could lie about its identity and pretend through CDP that it's a controller, an AP, a printer and so on.   That's why the best option, in my opinion would be that the AP sends its credentials and ISE accept it or reject is. It's possible to do this with the Cisco APs http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99791-eapfast-wlc-rad-config.html   I'm wondering why Cisco chooses a different EAP method for each of their devices (EAP-MD5 -> Cisco Phones, EAP-FAST -> AP)   So in my humble opinion, the mab/profiling solution is good but not optimal.   ... View more

Hello, First thank you for your participation in this question. I've read a couple of times all the answers but I'm not sure I get it all. The goal is of course to make sure a legitimate user uses a legitimate device without using Anyconnect (EAP chaining) a) You told me that MAR ("Network Access:WasMachineAuthenticated = True") has some drawbacks. When hibernation is used it can cause problems since the MAC address could have been removed from the cache when the user un-hibernate its computer. Then why not increasing the MAR cache to a value of 7 days then ? Regarding the roaming between wire and wireless it's a problem indeed. b) You suggest to use one authorization rule for the device which should be part of the AD and one authorization rule for the user with the extra result "IdentityAccessRestricted = False". By the was, are we really talking about authorization rules here ? I will try this but it's difficult for me to imagine how it would really work. z) One question I was asking myself for a long time. All of us want to do machine+user authentication but Windows write Machine OR User Authentication. This "OR" is very confusing. Thank you ... View more

Hello, Thank you very much for your answer. Why do you say that AP should be authenticated via MAB and profiling instead of dot1x. Why is it better ? Using dot1x seems to work fine for me except what I talked about and also that ISE thinks my AP is a router. Regards ... View more

Hello, I have one done (not finished) one deployment with 150 clients. And one guy I know is doing a very large scale deployment. To me it's very interesting but very challenging. I really under estimated the time it would take. I did this project because my client wanted it. From a technical point of view it's very positive for me, from a financial point of view it's really bad as I've spent a lot of time. The client is so far very happy although some implemented features are missing. I would recommend to start with Wifi only and once you understand ISE and know how to troubleshoot make Wire to work. I have not tried remote access though. Some hints: - You're full Cisco or you have other vendors (I'm thinking about IP Phones but the question can also be asked for switches and wlc) - You have a PKI or not. - You have devices (endpoints) and they are not 802.1X capable. All of us have, but the important is to list them.   It's also difficult because it involves a lot of components and protocols: - Components: The radius server (ISE), the NAS (Switch or WLC), the endpoints (PC, APs, printers), the host (in my case VMWare) - Protocols: EAP protocols, Snmp/DHCP for profiling, Wifi etc. So I wouldn't see a guy with a little experience in networking dealing with something like this. I was more than familiar with many of these things. And before ISE I also tried Freeradius and made is work with Wifi and Vlan assignement and a LDAP server. If by chance I make the whole thing to work I need to give the skills to someone else to do a troubleshooting. So this is my experience so far. Some other have much more experience of course. ... View more

Buongiorno Massimo, Thank you for your answer. It's really helpful, I didn't know where to start that troubleshooting. I'm surprised by the number of hotfixes in Windows 7 SP1. I would have expected that 802.1X was quite mature on that platform.   ... View more