Hi all,   I have 1 Nexus 3548 switch in each Data Centre spanned across to each other. One switch is Layer 3 the other is Layer 2 for vlan 899.   Switch A (Layer 3 for vlan 899) doesn't seem to be processing IGMP membership reports requests from hosts on Switch B (layer 2 vlan 899). The port-channel across sites is Po1 configured on both switches, mrouter port for vlan 899 is Po1 on both switches. However "sh ip mroute" on Switch A doesn't show these 2 particular hosts on Switch B. IGMP snooping is enabled.   If I span traffic to a Wireshark box for both hosts on Switch B I can see IGMP traffic every 15 seconds leaving (v2 IGMP Member reports), however if I span Po1 on Switch B or Port 1 on Switch A I do not see these host requests. I see plenty of other multicast packets going across Po1 on both switches working fine, it's just this one particular IGMP group I cannot see.   The fact I cannot see the hosts IGMP queries on Switch B Po1 suggests to me to me that Switch B's Control Plane is doing something weird with these packets and not processing them. My 1st thought was to turn off IGMP snooping for this particular group but not ideal. This problem appeared after I upgraded the code on Switch A (L3 for vlan 899) to 7.0(3)I7(6)....... Switch B (L2 for vlan899) is running 6.0(2)A8(4a)...I excluded Switch B from the upgrade when I discovered the problem Monday after application teams showed me.   Switch B   # show ip igmp snooping mrouter vlan 899 Type: S - Static, D - Dynamic, V - vPC Peer Link I - Internal, F - Fabricpath core port C - Co-learned, U - User Configured P - learnt by Peer Vlan Router-port Type Uptime Expires 899 Po1 D 1w3d 00:04:58   # show ip igmp snooping vlan 899 IGMP Snooping information for vlan 899 IGMP snooping enabled Lookup mode: IP Optimised Multicast Flood (OMF) disabled IGMP querier present, address: 10.210.89.2, version: 2, i/f Po1 Switch-querier disabled IGMP Explicit tracking enabled IGMPv2 Fast leave disabled IGMPv1/v2 Report suppression enabled IGMPv3 Report suppression disabled Link Local Groups suppression enabled Router port detection using PIM Hellos, IGMP Queries Number of router-ports: 1 Number of groups: 61 VLAN vPC function disabled Active ports: Po1 Po3 Eth1/8 Eth1/15 Eth1/24 Eth1/28 Eth1/29 Eth1/40 Eth1/44 Eth1/45   Switch A   # sh ip igmp snooping vlan 899 Global IGMP Snooping Information: IGMP Snooping enabled Optimised Multicast Flood (OMF) enabled IGMPv1/v2 Report Suppression enabled IGMPv3 Report Suppression disabled Link Local Groups Suppression enabled IGMP Snooping information for vlan 899 IGMP snooping enabled Lookup mode: IP Optimised Multicast Flood (OMF) enabled IGMP querier present, address: 10.210.89.2, version: 2, i/f Vlan899 Querier interval: 125 secs Querier last member query interval: 1 secs Querier robustness: 2 Switch-querier disabled IGMPv3 Explicit tracking enabled IGMPv2 Fast leave disabled IGMPv1/v2 Report suppression enabled IGMPv3 Report suppression disabled Link Local Groups suppression enabled Router port detection using PIM Hellos, IGMP Queries Number of router-ports: 1 Number of groups: 73 VLAN vPC function disabled Active ports: Po1 Po3 Eth1/8 Eth1/15 Eth1/24 Eth1/28 Eth1/29 Eth1/40 Eth1/44 Eth1/45 Report Flooding: Disabled Interfaces for Report Flooding: n/a Use Group Address for Proxy Leaves: no   # sh ip igmp snooping mrouter vlan 899 Type: S - Static, D - Dynamic, V - vPC Peer Link I - Internal, F - Fabricpath core port C - Co-learned, U - User Configured P - learnt by Peer Vlan Router-port Type Uptime Expires 899 Vlan899 ID 1w3d 00:03:49     ... View more

WLC 5508   ISE - When using single SSID for BYOD from iPhone versions 12.x and onwards you need to apply config network web-auth captive-bypass enable on all your WLC's in order for the iPhone browser to be supported so supresses. That's a problem for me as Guest users with iPhones are no longer presented a login page.   Does anyone know if config network web-auth captive-bypass enable is supported on a per SSID basis? This would solve my issue!   Someone mentioned to me from WLC 8.4.x this option should be seen in the GUI not sure where or cmd line because @moment this command is a global command meaning all SSID's are enabled once the command is applied.   Thanks. ... View more

Hi Cisco community,   I've been working with a TAC Engineer for the last few days trying to sort my Android problem out (though I haven't tested Apple devices yet!)   I'm getting the same error explained in this document https://community.cisco.com/t5/security-documents/android-byod-provisioning-error-quot-certificate-generation/ta-p/3733734   Single SSID - Can login to BYOD successfully with Active Directory account Redirects me to BYOD portal, click start Register my Device successfully in Device Portal Run my Cisco CNA Proceed and Trust Certificate Network password is required, I enter my AD password same one as 1st step above "Certificate generation failed"   I'm running VE ISE 2.4 Patch 7 and NSA 2.2.0.55 With the TAC engineer we went over and over again changed configs in WLC ALC's, Authorization profiles, Policy Sets, Generated a New Self Signed Certificate with another Certificate Portal.........basically Engineer went through in detail from what I could see.   For some reason after following this document, we never see counter hits against these rules in our Policy sets, we have added the rule at the top added a separate policy set to see if this would work, still no hits. Note EST Service is running. The fact we cannot see any hits against these rules as suggested in this workaround doc means to me that we are missing something here.   Below are my Android SPW logs:   2019.04.15 20:43:01 INFO:EST Server =test.test.com 2019.04.15 20:43:01 INFO:EST Server port =8084 2019.04.15 20:43:01 INFO:ISEDownloadProfileAsynchTask.onPostExecute :PASSED 2019.04.15 20:43:04 INFO:Location Permission for the App is granted. 2019.04.15 20:43:13 INFO:Making SCEP call 2019.04.15 20:43:13 INFO:Generating RSA key with key size: 2048 2019.04.15 20:43:13 INFO:Going to call EST server with args: cn = ga2paen, un= ga2paen, sn= test.test.com, sp =8084, cur= P-384, ca_certs length = 4002 2019.04.15 20:43:13 INFO:Calling native logger init with : /storage/emulated/0/Download/estlog.txt 2019.04.15 20:43:13 INFO:SPW profile is having certificate parameters 2019.04.15 20:43:13 INFO:EnrollCert Native returned pem len = 16384 2019.04.15 20:43:13 ERROR:ISEEnrollmentAsynchTask 2019.04.15 20:43:13 ERROR:java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String java.security.cert.X509Certificate.toString()' on a null object reference 2019.04.15 20:43:13 ERROR:Attempt to invoke virtual method 'java.lang.String java.security.cert.X509Certificate.toString()' on a null object reference 2019.04.15 20:43:13 INFO:Internal system error.   Here are my Android EST logs:   ***EST [INFO][ossl_init_cert_store_from_raw:182]--> Adding cert to store (/CN=Certificate Services Endpoint Sub CA - sv195978) ***EST [INFO][ossl_init_cert_store_from_raw:182]--> Adding cert to store (/CN=Certificate Services Root CA - sv195978) ***EST [INFO][est_log_version:156]--> libest 1.1.0 (API level 3) ***EST [INFO][est_log_version:160]--> Compiled against CiscoSSL 1.0.1p.4.13 ***EST [INFO][est_log_version:161]--> Linking to CiscoSSL 1.0.1p.4.13 ***EST [WARNING][est_client_set_auth:3439]--> Not using client certificate for TLS session, HTTP basic or digest auth will be used. ***EST [INFO][cert_verify_cb:671]--> entering: Cert passed up from OpenSSL. error = 26 (unsupported certificate purpose)   ***EST [WARNING][cert_verify_cb:764]--> Certificate verify failed (reason = 26) (unsupported certificate purpose) ***EST [ERROR][est_client_connect:2245]--> Error connecting TLS context ***EST [WARNING][ossl_dump_ssl_errors:246]--> OSSL error: 3386898888:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1285:   Any ideas? Thanks ... View more