Hello, I've installed the efm module on a Cisco 829 managed through the kinetic gmm, but I can't modify the broker.json configuration file to configure the efm to connect to an upstream EFM virtual machine, because I can't access the IOX local manager on the router. I was able to do that on a standalone 829 (following these instructions), because I had the credentials to access the iox local manager, but I can't do that on a GMM managed device, because I don't have credentials for the router.   Any ideas?   Thanks, Silla Rizzoli ... View more

Hello, I'd like to share a couple of ideas for features I'd like to see in the next versions of ISE: as far as I know, they are not available, but feel free to correct me if I'm wrong!   1) Ability to modify Policy Sets via REST API:  it is already possible to modify lots of things via API (complete list here); however, policy sets cannot be created/modified/deleted via API. This is like having a bathtub full of lego bricks and not being able to play with them!   2) Ability to use references to attributes in authorization profiles: that would allow for some pretty neat tricks. Let's suppose, for example, that you want to use the Identity PSK feature of Cisco WLC 8.5; this is a new feature that allows you to set different pre-shared keys for different clients for an SSID using WPA-PSK (see here for an overview). However, if I'm not mistaken, you have to write a new authorization rule and a new authorization profile for every different PSK. It would be much better, in my opinion, to simply add an attribute to the Endpoints (let's call it ipsk) and reference it in a single authorization profile.   Instead of having multiple authorization profiles like these, each with its own authorization rule...   Access Type = ACCESS_ACCEPT cisco-av-pair = psk-mode=ascii cisco-av-pair = psk=SharedPassword1   Access Type = ACCESS_ACCEPT cisco-av-pair = psk-mode=ascii cisco-av-pair = psk=SharedPassword2   Access Type = ACCESS_ACCEPT cisco-av-pair = psk-mode=ascii cisco-av-pair = psk=SharedPassword3   You would have a single authorization profile, with a reference to the attribute and a single authorization rule, referencing the "dynamic" authorization profile.   Access Type = ACCESS_ACCEPT cisco-av-pair = psk-mode=ascii cisco-av-pair = psk=$InternalEndpoint.ipsk   This feature would not be strictly necessary if we had feature #1, but would still allow for much more compact authorization rules. The predefined authorization profile Cisco_WebAuth already has something like that:   Access Type = ACCESS_ACCEPT cisco-av-pair = url-redirect-acl=ACL_WEBAUTH_REDIRECT cisco-av-pair = url-redirect=https://ip:port/portal/gateway?sessionId=SessionIdValue&portal=404e0f70-2e02-11e8-ba71-005056872c7f&action=cwa   The references ip, port and SessionIdValue are populated at runtime.   Is there some Cisco overlord out there that can tell us if something like this has ever been considered?   Best regards, Silla ... View more

Hello, I'm trying to authenticate Anyconnect (or Clientless VPN) using Microsoft ADFS, but I can't get it to work. I'm especially clueless on how to configure the ADFS side. I've done this to authenticate an ISE Sponsor portal, it's very easy, ISE provides a nice XML configuration file that I can import into ADFS, but there's nothing like it on the ASA documentation, not even how to do it manually. Is there anyone who can help me? Thanks, Silla Rizzoli ... View more