Hello dear CISCO community !    I need some help regarding FlexVPN configuration.  I have a "central" router used as a VPN concentrator for several IR829 routers (4G mobile routers).  Those routers use rsa-sig authentication on their ikev2 profile. The certificate is then checked by our "central" router.    I would ilke to offload the authentication for those FlexVPN on ISE. I saw several configuration examples for anyconnect authentication, but not for client routers using certificates.  Could you help?      Anthony  ... View more

Hello CISCO community !    Does any of you have tested MPLSoDMVPN (mGRE) with NHRP on Catalyst 9500 ?  We have this solution running on our distribution (6880 switches) with no issues.  The same configuration on Catalyst 9500 (C9500-16X-A) running either 16.9.2 or 16.10.1 does not works at all.    BGP routes are perfectly exchanged, packets are correctly routed and sent over the tunnel, responses are also received, but seems completely ignored by the switch...    If you have some experience of feedback using this configuration on those new switches...    Best regards ... View more

Hello guys !   Another question about ISE :-) I would like to return the endpoint group name as an Advanced attribute value on an authorization profile. The reason : several endpoint groups, each one corresponding to a VLAN name. I want each endpoint to have the VLAN corresponding to its endpoint group dynamically assigned. That's why I need to return the endpoint's endpoint group name as a value for the Tunnel-Private-Group-ID RADIUS attribute.   This attribute is not available on the "endpoints" categorie of the Advanced attributes values:   There's a "name" value available on the "Identity Group" category, but when I try with this one, the attribute is not returned on the RADIUS response, and I have this log on the request detail:     Can someone help me on this topic? ... View more

Hello all,   I'm trying to configure auto-smart-port macros triggered via ISE (no CDP), to configure dynamically my access ports for FlexConnect access-points connection.   I created a macro, which is the following:   macro auto execute CISCO_FLEX_AP { if [[ $LINKUP == YES ]] then conf t interface $INTERFACE macro description $TRIGGER switchport trunk allowed vlan 200,2700-2799 switchport trunk native vlan 200 switchport mode trunk authentication host-mode multi-host spanning-tree portfast trunk exit fi if [[ $LINKUP == NO ]] then conf t interface $INTERFACE no macro description $TRIGGER no switchport trunk allowed vlan no switchport trunk native vlan authentication host-mode multi-auth switchport mode access no spanning-tree portfast trunk exit fi }   The macro is correctly triggered by the ISE when my AP is authenticated (via MAB, for now). Unfortunately, even if the port is converted to trunk mode with native VLAN 200, my access-point MAC address remains on the base access VLAN (1905) :   Access#sh mac add int gI1/0/28 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 1905 ecbd.1da3.xxxx STATIC Gi1/0/28 Total Mac Addresses for this criterion: 1   I also tried to combine this macro with the "NEAT" parameter on ISE (thus removing the "switchport mode trunk" from the macro and returning both the macro name an the  NEAT attribute from ISE), but the result is the same...   The switchport config is the following:   interface GigabitEthernet1/0/28 switchport access vlan 1905 switchport mode access switchport voice vlan 300 switchport port-security maximum 5 switchport port-security ip device tracking maximum 0 authentication control-direction in authentication event fail retry 1 action next-method authentication event server dead action authorize vlan 1905 authentication event server dead action authorize voice authentication event server alive action reinitialize authentication host-mode multi-auth authentication order dot1x mab authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate server authentication timer inactivity server authentication violation restrict mab mls qos trust cos dot1x pae authenticator dot1x timeout quiet-period 300 dot1x timeout server-timeout 18 dot1x timeout tx-period 3 dot1x timeout supp-timeout 5 dot1x timeout ratelimit-period 60 dot1x max-req 1 dot1x max-reauth-req 1 storm-control broadcast level 0.15 storm-control action trap no keepalive no cdp enable end     Can you help me ? (IOS : 15.2(2)E5 on WS-C2960X-48LPS-L)   Thanks ! ... View more

Hello all CISCO community !    Quick question : does someone knows if it is possible, on an ISE in policy set mode, to process several MAB policies sequentially ?  For manageability purposes, I would like to "split" my existing MAB policy in two.  If no rules are matched on the first policy, I would like the second one to be processed (thus implying to remove the default rule at the end of the first policy).    Any advise or workaround ?    Thanks !  ... View more

Hi all,    I'm currently working on an issue encountered on a DC.  We currently use 2 3750 stacks (1 in each DC), connected with a Po.  We use dark fiber between each DC, so we have a Ciena DWDM transponder on each side.  The problem is that, if we have an issue on the inter-DC fiber, the Ciena interface on the 3750 side is still up. Using LACP on the Po, the issue can be detected in about 3 X 30 sec = 90 sec.  Before the issue is detected by LACP, the impacted port-channel interface is still used by the Po, which can cause big issues.  I thought use an EEM applet in order to monitor the CDP neighbor on each interface, and exclude the interface from the Po till the CDP neighbor is down, but the CDP timers are even bigger (180 sec hold-time).  Is there any way to address this problem, other than UDLD ?    In our others DC, we have two NX7K on each side, and we are able to use LACP with fast-rate, but this is not available on 3750...    Thank you very much !  ... View more

Hi all,    I'm currently working on an issue encountered on a DC.  We currently use 2 3750 stacks (1 in each DC), connected with a Po.  We use dark fiber between each DC, so we have a Ciena DWDM transponder on each side.  The problem is that, if we have an issue on the inter-DC fiber, the Ciena interface on the 3750 side is still up. Using LACP on the Po, the issue can be detected in about 3 X 30 sec = 90 sec.  Before the issue is detected by LACP, the impacted port-channel interface is still used by the Po, which can cause big issues.  I thought use an EEM applet in order to monitor the CDP neighbor on each interface, and exclude the interface from the Po till the CDP neighbor is down, but the CDP timers are even bigger (180 sec hold-time).  Is there any way to address this problem, other than UDLD ?    In our others DC, we have two NX7K on each side, and we are able to use LACP with fast-rate, but this is not available on 3750...    Thank you very much !  ... View more