Hi all,   I have an ASR router terminating multiple 'guest wireless' VRFs, but the router is using a single ISP connection housed in the Global Routing Table. I require that client subnets within each VRF use the same ISP next hop address within the GRT.   I found the command below that lets me leak the default route from the GRT to the GUEST vrf (for example).   ASR WAN int - 1.1.1.1 ASR-->ISP next hop - 1.1.1.2 Client Subnet in GUEST VRF - 10.10.10.0/24     ip route GUEST 0.0.0.0 0.0.0.0 1.1.1.2 global     When the return traffic from the Internet arrives at the router, how do I route it back to the 10.10.10.0/24 within the GUEST VRF?   Can I simply use;   ip route 10.10.10.0 255.255.255.0 <GUEST_VRF_next_hop> What if I was using OSPF to advertise the internal client subnets (within each VRF) to the ASR router?   Unfortunately I don't have the ability to test this at the moment, it's still in design stage. I'm looking for the absolute easiest way to implement this. Don't have the ability to run BGP...   Any ideas would be greatly appreciated!   -Brett     ... View more

Hi there, I have a few questions around the Certificate Authentication Profile (CAP) in ISE. 1.)  If the goal is to only allow certificate based auth (EAP-TLS) do you NEED to select any of the identity stores in available list the Identity Source Sequence, if you have selected a CAP in the sequence? 2.)  There is an 'Identity Store' field in the CAP, can this be used in policy making decisions, (i.e. check the group membership of the user and assign VLANs etc through an AuthZ profile? 3.)  Does Binary Comparison on Certificates against AD create any overhead to the authentication process? Regards, Brett ... View more

Hi there, Looking for a RADIUS attribute that uniquely identifies 4G WAN authentication requests on a router. Using Policy Sets within ISE 2.2 to match incoming sessions and need to handle these requests separately from all other RADIUS/802.1X requests. Is there a RADIUS attribute that is unique to authenticating LTE/4G devices? Don't currently have a device to test, otherwise would look for a unique attribute on the session. -Brett ... View more

Hi there, I am deploying an ISE solution for a client who is using to authenticate a wide range of services. With the introduction of 'Device Administration Policy Sets', TACACs requests are handled and configured in a separate section. However RADIUS requests are still configured in the regular Policy Sets. I have a seperate condition each to match wired and wireless RADIUS requests, however I am looking for a condition that matches device admin RADIUS requests, so I can handle the requests in their own policy set. I am thinking I can match on something like: RADIUS:NAS-Port-Type = Virtual & (Network Access:AuthenticationMethod = PAP_ASCII or CHAP/MD5) But I just want to confirm that this will match all RADIUS admin requests, regardless of vendor or device type? Or is there a better way to do this? Regards, Brett ... View more