Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jan.nielsen
05-29-2019
Stats
Member since
03-08-2003
998
Posts
527
Helpful
112
Solutions
Created by
jan.nielsen
in Policy and Access
in Policy and Access
06-13-2018
03:38 PM
06-13-2018
03:38 PM
I would say medium, as those specs you posted are equal to the ones from the SNS-3595, which is what the medium license covers.
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
05-21-2018
05:21 PM
05-21-2018
05:21 PM
Just an addition, be aware that the small, medium, large names do not correspond to the deployment models that we use when scaling ise solutions.
VM Small = 3515 Sized VM
VM Medium = 3595 Sized VM
VM Large = Super MNT Sized VM (lots more memory mainly)
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
05-08-2018
03:51 PM
05-08-2018
03:51 PM
11
R-ISE-VML-K9=
$ 25200.00
NEW
Cisco ISE Virtual Machine Large
12
R-ISE-VMM-K9=
$ 12600.00
NEW
Cisco ISE Virtual Machine Medium
13
R-ISE-VMS-K9=
$ 6700.00
NEW
Cisco ISE Virtual Machine Small
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
04-05-2018
07:31 AM
04-05-2018
07:31 AM
Certainly, if your LEAP devices are on another wlan than your internal users/devices, this can be done. You can decide what eap protocols to allow in your authentication policy rules, ex. match the ssid and then select an Allowed Protocol defnition where LEAP is the only allowed protocol.
... View more
04-04-2018
12:27 PM
Correct, the built in common task "filter-id" option in ISE, can't be used with anything other than static text. But you should be able to use for example an internal user attribute or AD user attribute as the source for the content, if you add the av-pair manually. Just add filter-id attribute under the advanced attribute settings of the authz profile, in the example i added a custom attribute to internal users, but any string type attribute should do.
Jan
... View more
Created by
jan.nielsen
in Security Discussions
in Security Discussions
03-27-2018
04:07 AM
03-27-2018
04:07 AM
Sounds good, looking forward to it. Jan
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
03-15-2018
09:04 AM
03-15-2018
09:04 AM
Ok, but are you sure thats the cert that ise is actually sending to the browser? Also, if the cert is sha1, chrome will still not like it.
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
03-14-2018
02:28 PM
03-14-2018
02:28 PM
did you follow the trustsec guide for wired guest?
there is a few commands that are needed for cwa, which normally wouldnt be needed for dot1x/mab.
Also make sure the redirect ACL you are referencing actually exists on the switch.
Also, make sure you switch management ip and your guest client is in the same ip subnet, otherwise the switch will send the return packets to the client via the ip default-gateway configured in the switch, so if the mgmt network and the guest network cant reach eachother it won't work, or if you have a firewall between mgmt and guest network. A workaround is to configure multiple SVIs on the access switch, so it has an address in the guest network also, but it's kind of a pain to do CWA on wired, i always advice against it.
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
03-14-2018
02:19 PM
03-14-2018
02:19 PM
From the logs you posted, your client is not running EAP-TLS, it is clearly using PEAP-MSCHAP see id 11808, which uses username/password to authenticate not certificates, the TLS it mentions is the tunnel that is built using a trusted cert on ISE, not a cert on the client. Either your windows supplicant is incorrectly configured, or you didn't configure it at all. Once that is correctly configured, you should also check that your authentication policy allows EAP-TLS.
Jan
... View more
Created by
jan.nielsen
in Security Documents
in Security Documents
03-14-2018
02:06 PM
03-14-2018
02:06 PM
Nice explanation, maybe add to that, that if you are upgrading to something lower than 2.3(1), you will have to follow a fairly long upgrade path as desribed in the release notes. ex. 1.1(4) -> 2.2(1) is 3 or 4 updates after each other .-(
... View more
03-14-2018
02:01 PM
Like Arne said, this actually used to be possible as there was a more granular control of the guest authentication policy, now it's basically down to selecting the identity store/sequence under the guest portal. What i have done before is to connect using LDAP to AD, and then restrict the container where i look for users, then ISE will simply not be able to authenticate users that are not in that container, it probably won't work if you users are members of a group, only if they are actually located in the same place in your AD.
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
03-14-2018
01:53 PM
03-14-2018
01:53 PM
Your redirect ACL content would be interesting to see. Regarding Chrome, the gstatic url, is the url that chrome uses to detect if it has internet access, and if it's being blocked somehow, what you should see is the redirect to your portal, but i would suggest you get yourself a trusted public cert instead of some self-signed cert, also certs with SHA1 and not SHA256 algorithm (minimum) , will also have issues and chrome is especially security aware.
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
02-28-2018
05:40 PM
02-28-2018
05:40 PM
I actually just used curl from a command line, and called the api call that gives me all endpoint groups and their id's. Then i used the filter function on the get all endpoints api call, to get the mac adresses from each group that i wanted to re-import after deleting all mac adresses.
https://ise:9060/ers/config/endpointgroup
https://ise:9060/ers/config/endpoint?filter=groupId.EQ.id-number-of-the-group
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
02-28-2018
05:36 PM
02-28-2018
05:36 PM
Like Francesco says, if you are on a non company network, running the posture check, wont actually do anything, if you are concerned about users misunderstanding the dialogs coming from posture, you could look into the new silent anyconnect feature, where the client won't actually give the user any dialogs/messages at all.
... View more
Created by
jan.nielsen
in Policy and Access
in Policy and Access
02-27-2018
03:08 PM
02-27-2018
03:08 PM
Thanks for the suggestion, i tried this already and the problem is that with 1.4Mill endpoints this takes a very long time, as you cannot sort which endpoints you want. What i actually ended up doing was using the REST API, to pick endpoints from specific endpoint groups, that is used for MAB in the ISE, ands then i created a csv file for importing via the GUI, which i will do after deleting all mac addresses from ise. I also have around 8-900.000 mac adresses with just "blank" identity group...these also are not able to be purged either via endpoint purging rules.
... View more
04-24-2019
default is 20 per page, you can set it to a max of 100 with the size=100
parameter in the url, there...
Created by
jan.nielsen
in Identity Services Engine (ISE)
01-15-2019
01-15-2019
ok, thanks for the reply
Created by
jan.nielsen
in Identity Services Engine (ISE)
01-14-2019
01-14-2019
So, could you shed some light on question 2? 2. Can you explain more ?
Which certificate are we talk...
Created by
jan.nielsen
in Identity Services Engine (ISE)
01-14-2019
01-14-2019
Understood, i will let my local SE figure out how to keep us informed.
Created by
jan.nielsen
in Identity Services Engine (ISE)
01-11-2019
01-11-2019
@Surendra wrote:Answering your questions in order.1. No, it is not
possible to choose a specific CA ...
Created by
jan.nielsen
in Identity Services Engine (ISE)
12-14-2018
12-14-2018
Hi Surendra, I am the guy that was asking Tue about this, and i have my
customer the information you...
Created by
jan.nielsen
in Identity Services Engine (ISE)
09-06-2018
09-06-2018
The problem is that the issues you may run into at some point won't just
be performance, but actual ...
09-06-2018
Be very carefull with using interface id's for anything in a stack, if
you have to rebuild the stack...
Created by
jan.nielsen
in Identity Services Engine (ISE)
09-06-2018
09-06-2018
No, ISE does not have windows updates nor does it deploy updates to your
clients. What it does do is...
Created by
jan.nielsen
in Policy and Access
06-13-2018
06-13-2018
I would say medium, as those specs you posted are equal to the ones from
the SNS-3595, which is what...
Created by
jan.nielsen
in Policy and Access
05-21-2018
05-21-2018
Just an addition, be aware that the small, medium, large names do not
correspond to the deployment m...
Created by
jan.nielsen
in Policy and Access
05-08-2018
05-08-2018
11 R-ISE-VML-K9= $ 25200.00 NEW Cisco ISE Virtual Machine Large 12
R-ISE-VMM-K9= $ 12600.00 NEW Cisc...
04-05-2018
Certainly, if your LEAP devices are on another wlan than your internal
users/devices, this can be do...
04-04-2018
Correct, the built in common task "filter-id" option in ISE, can't be
used with anything other than ...
Created by
jan.nielsen
in Security Discussions
03-27-2018
03-27-2018
Sounds good, looking forward to it.Jan
Public Statistics
| Date Registered | 03-08-2003 02:43 PM |
| Date Last Visited | 05-29-2019 12:06 AM |
| Total Messages Posted | 998 |
| Total Helpful Votes Received | 527 |
Helpful Votes From
