Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Stephen McBride
Stats
Member since
06-05-2012
100
Posts
45
Helpful
2
Solutions
01-10-2019
05:23 PM
I understand that we can leverage delay but the whole point of the Wide stuff is to take into account bigger links in routing decisions. From my viewpoint it seems that it is not going to work unless we manually alter the bandwidth on all VLAN SVIs.
... View more
01-09-2019
11:53 PM
I have the same problem as David. Basically the problem is that by default a SVI has a bandwidth of 1g. So in my case the destination route is an SVI with a bandwidth of 1g meaning the lowest bandwidth on the path is 1G even though the whole path to that last hop is 10G. It is a pain and I think an oversight from Cisco. I think the default bandwidth of all SVIs should have been increased with the introduction of named mode to cater for this issue.
... View more
03-23-2018
07:11 PM
Easy question. Does anyone have a link to or the procedure for password recovery on a 6840x? I flat out cannot find any documentation around this for the 6800 family of switches.
... View more
Labels:
04-03-2017
03:51 PM
Basically ISE is joined to the domain in pretty much the same way that a desktop is joined to the domain. Basically any account that can join a host to the domain can be used. Further to this the credentials don't need to be persistent/stored on ISE.
... View more
04-02-2017
06:02 PM
I can't answer the entirety of the topic but in terms of the user not re-registering for a guest account you can prevent that on a per device basis by creating and Authorisation rule that matches the GuestEndpoint group (device) and provide a different Guest Portal that doesn't support self-registration.
You can then create purging rules that delete those endpoints every 24 hours or so meaning once purged their device will be eligible to login again
... View more
08-17-2015
06:17 PM
There is a possiblility you could do profiling using the DHCP class-ID (PXE boot). Based on that profiling you could give the precise access required. It all depends on the imaging setup been used but there is most likely a differentiating factor that would allow you to do this.
... View more
07-27-2015
04:37 PM
Can anyone add any clarity on this topic with regards to ISE? Can the same license be applied to ISE or do you need to purchase separate AC Apex licenses for ISE and ASA?
... View more
02-10-2015
02:31 PM
Fixed the issue. I did some debugging and looking through logs and found that there is a bug. Basically you need to enable the sponsor to select the language dictionary for email notifications and it fixes the issue. It is under the customisation section of the relevant sponsor portal under settings of known guest
... View more
Created by
Stephen McBride
in Policy and Access
in Policy and Access
02-01-2015
08:55 PM
02-01-2015
08:55 PM
Just ran into an issue with ISE 1.3 email notifications and was hoping that I might have overlooked a setting. Basically if I create a self-registered guest ISE will send an email to both the listed sponsor and a confirmation email to the guest with credentials – this works fine. Furthermore I can go to the sponsor portal and click the self registered user then resend the credentials – this also works. My problem is when I create a "known guest" user from the sponsor portal. Basically I create the account and hit the notify button, select email and click ok – ISE then throws an error saying unable to send email. I click the user and click resend and likewise I cannot send an email. So in summary email notifications work for self registered guest type but not a known guest type.
... View more
Labels:
11-25-2014
08:38 PM
Have you tried this scenario in 1.3 yet? I notice you stated that one way trust seems to work in 1.1.3? Basically it would appear that a two way trust is still a requirement for multidomain forests in 1.3. I am curious about why a two way trust is required to authenticate users in this type of setup. Not sure why an external one way trust wouldn't suffice. Does anyone have any experience with this in 1.3 as I am unable to join one of the required forests directly (due to internal policy) and the client is unwilling to configure a two way trust.
... View more
11-23-2014
08:52 PM
No offence but can you explain to me the point of this post in the context of everything that is discussed here in this thread? For what it is worth I know how to configure profiling but have no idea how to get around the fact that ISE receives the wrong information and won't reprofile or select the right information to make a descision. For this particular version of ISE the only workaround has been to manually assign the device to the right profile. I haven't seen the issue in 1.3 yet so hopefully it is fixed but yeah not so sure. Is there something in your link that has the answer or is it a throw away link to bump a post count?
... View more
08-21-2014
03:13 PM
I have intermittently had this issue with ISE in most builds for the better part of a year or so. SOme days everyting is fine other days this occurs for hosts even when validate is not ticked. Tell me about the server certificate on the ISE policy node - is it a wildcard certificate?
... View more
08-13-2014
09:43 PM
If you are using Cisco IP phones you can get away with single-host mode on the port which in effect ignores the phone. If the phone is a third party device you will most likely need to use multi-domain authentication and actually use ISE to allow the phone on the network. In summary - CIsco phone means potentially no license, if Avaya or other third party you will need to auth and use a license
... View more
08-13-2014
09:39 PM
https://supportforums.cisco.com/discussion/12263486/ise-12-profiling-user-agent-attribute-incorrect Check this thread out. Willing to punt some money that you are likely experiencing the same issues as myself.
... View more
07-30-2014
03:18 PM
1 - I've seen this issue on many deployments but until recently had not really looked at it. 2 - Standard type settings aaa override, RADIUS NAC, RADIUS client profiling DHCP and HTTP. 3 -I have just checked and HTTP probe is definately enabled on this deployment. Either way the user agent string from http is gathered successfully but as described ISE is holding onto the wrong string presented by other applications
... View more
You Have No Messages
Public Statistics
| Date Registered | 06-05-2012 03:46 PM |
| Date Last Visited | 05-03-2019 01:42 AM |
| Total Messages Posted | 100 |
| Total Helpful Votes Received | 45 |
Helpful Votes From
