I am able to perform a restconf query to extract IP-SGT mappings for a global vrf using belw   I am now trying to fetch mappings for a particular and need to pass the vrf-name to the get query.  Can't figure out how to construct my Get request. Any help is appreciated. ... View more

I can form simple Restconf query from simple Yang models like below.       I know 'augment' is for extended data models. Can someone explain how can I create a restconf query for below data model ?   ... View more

A customer of mine wants to create bypass filter list under collection filter via API. Eg. Bypassing Suppression via API etc.   Is there an API support for it ? ... View more

Our customer is looking to install Anyconnect NAM since it offer EAP chaining and higher level of security than Windows Native Supplicant however recently it has come to our notice that there are issues with NAM while doing Windows upgrage and Windows patch management where it requires us to uninstall NAM before applying the patch. What is the best practice in implementing Anyconnect NAM ? ... View more

Hi, We are seeing huge number logs on ISE coming from MAC address 00:00:00:00:00:00 from different switches The show authentication session output from the switch is shown below The interface is configured with multi-auth and the phones and machines are working properly in DATA and VOICE domain. Has anyone observed these logs before ? What could be source of these requests ? I do not see any such entry in the mac address table from that interface ... View more

Is it possible for remote access Anyconnect VPN users with non-admin rights to be able to authenticate using machine certificates ? This feature was supposed to be added to Anyconnect 2.3 (mentioned in one of cisco internal documents) however we have tried using Anyconnect 3.1 and  are not able to pass machine certificates for authentication without running Anyconnect  as admin.  It works fine when Anyconnect is run as an admin access. Was this feature never added to any of the Anyconnect versions or are we encountering some bug ? Also is this feature available in Anyconnect 4 ?     ... View more

How can we use DAP in Anyconnect VPN to authorize network access to remote users by validating domain-name in machine certificates against an AD and ISE as a radius server ?   ... View more

We need to achieve a scenario where remote users connecting via anyconnect SSL through corporate assets(laptop) could able to authenticate using AD credentials. Corporate laptop has been issued machine certificate. In tunnel group (connection profile) , I could see that we can have cert ,aaa or Both authentication.  If we configure as a  'Both'. How we can achieve following 1. Strip CN from certificate and send it to AAA (ISE) for further authentication. I could see that in Advanced option of connection profile we can send to AAA server for further validation but how can we prevent from not prompting user for password as it does not make sense prompt for pop-up against machine name. 2. We will  have secondary authentication which prompt user to enter their AD credential but that is not an issue. If above scenario is not possible then for remote access user, is there any way we can achieve machine authentication(certificate) and user authentication(AD  credential) through ASA -AAA(ISE)  ? ... View more