Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jedavis
Stats
Member since
11-07-2002
326
Posts
50
Helpful
2
Solutions
Created by
jedavis
in Network Access Control
in Network Access Control
03-11-2020
12:48 PM
03-11-2020
12:48 PM
Your suggestion is a little outside my comfort zone but I think I somewhat understand what you are suggesting. The problem is that the users do not have a one-to-one relationship with the network resources they access. In other words, USER1 in DOMAIN-A may have access to resources in one or many of the other domains. But I did get this working. Create AD groups DOMAIN-B\DOMAIN-B_access-group and DOMAIN-A\DOMAIN-B_access-group. These are both universal AD groups (though I think that the DOMAIN-A\DOMAIN-B_access-group can probably be local - I haven't tested yet). Place DOMAIN-A\USER-A in into group DOMAIN-B\DOMAIN-B_access-group Nest group DOMAIN-B\DOMAIN-B_access-group within group DOMAIN-A\DOMAIN-B_access-group. So now my authorization policy checks to see if DOMAIN-A\USER-A is in group DOMAIN-A\DOMAIN_B_access-group. And it succeeds. So what does this do for me? It allows me to place all users with access to DOMAIN-B resources into a the single group DOMAIN-B\DOMAIN-B_access-group. And similarly for all of the other domains in the forest. Domain admins for each domain can control access to their own resources. All ISE AAA operations are performed against DOMAIN-A. So to summarize, each domain may have contain many different sites. A universal group will be created for each site in the domain that site is a member of. This universal group will contain only users, but may contain users from any domain in the forest. DOMAIN-A will also contain a single local group for each site within the other domains. This local group will only contain the nested universal group for that site. The sole purpose of this container group is to allow AD authentication and authorization using DOMAIN-A for any user, from any site to gain access to resources at any other site. Thanks for you help with this!
... View more
Created by
jedavis
in Network Access Control
in Network Access Control
03-09-2020
01:26 PM
03-09-2020
01:26 PM
There are 30 - 40 firewalls. The goal is to maintain a single AD group that governs access to network resources. So in DOMAIN-A there is a group that is used to permit access to DOMAIN-A resources. But I want users from DOMAIN-B to also be able to authenticate and gain access to those DOMAIN-A resources. Now I could just create a group within DOMAIN-B to permit access to those DOMAIN-A resources. But now I have users within groups that are scattered across domains. If I want to see who has access to DOMAIN-A resources I need to check a group in each domain, and I would like to stay away from that. Any ideas? Thanks!
... View more
Created by
jedavis
in Network Access Control
in Network Access Control
03-03-2020
03:09 PM
03-03-2020
03:09 PM
I have a Windows forest with 4 domains. I want to authenticate a user against DOMAIN-A and then check that same user for group membership in DOMAIN-B. So authentication policy says If Radius:User-Name CONTAINS DOMAIN-A use DOMAIN-A and authorization policy says If DOMAIN-B:ExternalGroups EQUALS domain-b.company.com/blah/blah/blah When I try this authentication succeeds but it looks like it searches DOMAIN-A for group membership. Can I get it to search DOMAIN-B instead? And what does "Queried PIP" mean? 24402 User authentication against Active Directory succeeded - HOUPCS 22037 Authentication Passed 24423 ISE has not been able to confirm previous successful machine authentication 15036 Evaluating Authorization Policy 15048 Queried PIP - DOMAIN-B.ExternalGroups 24432 Looking up user in Active Directory - DOMAIN-A 24355 LDAP fetch succeeded - domain-a.company.com 24416 User's Groups retrieval from Active Directory succeeded - DOMAIN-A 15048 Queried PIP - DOMAIN-A.ExternalGroups 15048 Queried PIP - DOMAIN-B.ExternalGroups (2 times) 15048 Queried PIP - DOMAIN-C.ExternalGroups (2 times) 15048 Queried PIP - DOMAIN-D.ExternalGroups 15048 Queried PIP - DOMAIN-C.ExternalGroups 15048 Queried PIP - DOMAIN-A.ExternalGroups (2 times) 15004 Matched rule - Default 15016 Selected Authorization Profile - DenyAccess 15039 Rejected per authorization profile 11003 Returned RADIUS Access-Reject Thanks for any help you can provide. -Jeff
... View more
Labels:
Created by
jedavis
in Network Access Control
in Network Access Control
02-27-2020
02:06 PM
02-27-2020
02:06 PM
That was a great demo. Very informative But how about something like this. I have several ASAs and I want to have users authenticate to gain access through firewall only if the user has group membership that is tied directly to a the specific firewall they are authenticating from. For example, I have firewalls named: AAA-ASA BBB-ASA CCC-ASA Then there are AD groups associated with each firewall named something like AAA Network Access, BBB Network Access, etc. A user may have membership in one or several of these AD groups. So the brute force method is: If device-name = "AAA-ASA" check "AAA Network Access" membership If device-name = "BBB-ASA" check "BBB Network Access" membership etc... How can I write the policy so that I plug in a variable name and check once? Something like $Site = substring(device-name, 1, 3) check ${Site}+" Network Access" membership Can that be accomplished? The variable wouldn't necessarily need to come from the device name. Maybe some other RADIUS attribute.
... View more
Created by
jedavis
in Small Business Support Blogs
in Small Business Support Blogs
01-21-2020
06:59 AM
01-21-2020
06:59 AM
Right, so lets compare two 8 port full power models C1000-8FP-2G-L Catalyst 1000 8port GE, POE, 2x1G SFP C1000-8FP-E-2G-L Catalyst 1000 8port GE, Full POE, Ext PS, 2x1G SFP PWR-ADPT-150W Power adaptor, 150W, Catalyst 1000 Series The only difference between these 2 models is that one has an integrated power supply and one has an external power supply. What advantage does one have over the other? IMO not much. The only reason that I can think of to get the one with the external PSU is so you can have a spare on hand. But if I can't order a spare that advantage vanishes. I suppose you could make an argument for greater longevity due to less heat in the chassis, but the data sheet doesn't make this differentiation. So... what is the advantage of the external power supply?
... View more
Created by
jedavis
in Small Business Support Blogs
in Small Business Support Blogs
01-20-2020
12:45 PM
01-20-2020
12:45 PM
I see that there are 8 and 16 port models that have an external power supply. But I can't seem to find a spare power supply SKU. Are spare power supplies for the external PSU models available?
... View more
11-26-2019
11:14 AM
Rolling back to the original version doesn't clear it. Once it appears the switch is a brick. It isn't a software issue.
... View more
10-29-2019
08:05 AM
Since upgrading from virtualized Prime 3.6 to 3.7 we are experiencing frequent application hangs. I just can't log in, the wheel spins forever. From the CLI a show app status NCS shows everything running. CPU is not taxed. Not sure what is going on. I have to stop NCS and restart. Has anyone else experienced this? Thanks, -Jeff
... View more
Labels:
10-22-2019
07:00 AM
As far as I know replacement is the ONLY way to fix it is to RMA the switch. But it would be nice to know what switches have the defective hardware prior to attemtping an upgrade. I currently have a pile of 7 defective switches.
... View more
10-21-2019
07:41 AM
The news is that I got a call at 5:00 AM this morning. One of my sites in Germany had a power failure on a stack of 2 switches. Since I have previously loaded new IOS on all of these switches one of them came back up exhibiting this error. We took a spare out of the box and it too failed with the same problem. The third switch worked. This is the only site that I have these problems and it is as common for a switch to fail an IOS upgrade here as it is to have a successful upgrade. I have to believe this particular batch of hardware was acquired while Cisco was churning out defective product. It would sure be good to know what serial numbers are affected. Cisco? Are you listening?
... View more
Created by
jedavis
in Network Management
in Network Management
10-04-2019
08:05 AM
10-04-2019
08:05 AM
I forgot to mention that I just upgraded to PI 3.7 hoping that the search function would miraculously appear. If it did I can't find it.
... View more
Created by
jedavis
in Network Management
in Network Management
10-04-2019
08:04 AM
10-04-2019
08:04 AM
Where is the ability to search the configuration archive? Let's say, for example, that I want to find all devices that have a particular syslog server specified. I want to throw a simple search out there to see what devices have "logging host 1.2.3.4" in the latest configuration. Is this functionality lacking in PI? Believe it or not I still have an LMS installation collecting configurations solely to provide this functionality. My server admin wants to retire the W2K8 server that LMS is running on and I want to let him, but I absolutely need the archive search function. I see a few posts out here asking the same question but no replies. Anyone?
... View more
Labels:
08-16-2019
07:29 AM
I have seen this issue in all its various forms, whether relating to the SFPs, the stacking modules or the switch itself. I was recently upgrading all 2960X stacks to remediate a security vulnerability. I successfully upgraded 49 stacks at various sites without incident. I am unsure how many switches that represents but at least 150. Then I moved on to a site in Europe with 22 switches in very small stacks of 1 - 3 switches. I loaded them all with 15.2(4)E7 and before my maintenance window came one of the stacks of 2 switches reloaded due to a power failure. I received the POST: ACT2 Authentication : End, Status Failed boot message followed by the %ILET-1-AUTHENTICATION_FAIL: This Switch may not have been manufactured by Cisco IOS message on one of them while the other one upgraded successfully. So they grabbed a brand new spare off the shelf and I did an IOS upgrade on that before adding to the stack. It also failed with the same error. A second spare upgraded successfully. I tried everything I could think of to resurrect the 2 switches. Tried the published power cycle trick with no success. Tried factore reset, various IOS images including the original one with no success. Finally called TAC and had the 2 failed switches RMA'ed. Through some mixup they sent 4 switches. One of the switches was DOA. Since then I have upgraded 10 additional switches one stack at a time and have had 2 more failures. I have 10 more to go but we need to RMA some more switches first. I need to be sure that I have enough switches on hand to cover a failure of every stack member. Luckily at this site the most switches in any one stack is 3. My biggest fear is an extended power outage at the plant and they will all reload. How many will survive is anyone's guess. It would appear that once this occurs there is no software remedy so by definition this is a hardware failure of some sort. I have to believe Cisco knows what causes the failure and what serial numbers might be affected. But I have never seen this published. My theory is that there is such a huge number of possibly defective switches that they are just not willing to proactively replace them all. So that means I have to slog through these upgrades one at a time and hope for the best. -Jeff
... View more
Created by
jedavis
in Wireless and Mobility
in Wireless and Mobility
07-29-2019
06:51 AM
07-29-2019
06:51 AM
I changed the address on a pair of 5508's in HA mode this weekend. I was unable to find a detailed procedure to do this so I thought I would post it here. These are running 8.2.166.0. First, I changed the primary controller for all of the access points to my new address using Prime. If you do not have Prime you would need to issue this command for each AP: config ap primary-base <wlc name> <wlc address> Or from the GUI, select an AP, click on the High Availability tab and enter the WLC name and new address as the primary address. You could also use your current address as primary and the new address as secondary. I also enabled ssh for the AP's globally so I could connect to them remotely if I had problems getting them to join on the new address. Luckily I didn't. Procedure PRIMARY: Disable WLANS config wlan disable all PRIMARY: Disable HA mode (controllers will reboot) config redundancy mode disable STANDBY: Change the management IP address: config interface address management 10.0.0.19 255.255.255.240 10.0.0.17 STANDBY: Change the VLAN assignment on the management interface config interface vlan management 23 STANDBY: Change the redundancy management address: config interface address redundancy-management 10.0.0.21 peer-redundancy-management 10.0.0.20 STANDBY: Enable all ports config port adminmode all enable PRIMARY: Change the management IP address config interface address management 10.0.0.18 255.255.255.240 10.0.0.17 PRIMARY: Change the VLAN assignment on the management interface config interface vlan management 23 PRIMARY: Change the redundancy management address config interface address redundancy-management 10.0.0.20 peer-redundancy-management 10.0.0.21 PRIMARY & STANDBY: Enable HA mode. Controllers will reboot. Issue on primary first, then standby. No need to wait for primary to complete bootup before issuing on standby config redundancy mode sso PRIMARY: Enable WLANS config wlan enable all Verify (WLC1) >show interface summary Number of Interfaces.......................... 5 Interface Name Port Vlan Id IP Address Type Ap Mgr Guest -------------------------------- ---- -------- --------------- ------- ------ ----- management LAG 23 10.0.0.18 Static Yes No redundancy-management LAG 23 10.0.0.20 Static No No redundancy-port - untagged 169.254.0.20 Static No No service-port N/A N/A 0.0.0.0 Static No No virtual N/A N/A 1.1.1.1 Static No No (WLC1) >show redundancy summary Redundancy Mode = SSO ENABLED Local State = ACTIVE Peer State = STANDBY HOT Unit = Primary Unit ID = 4C:00:82:71:E6:40 Redundancy State = SSO Mobility MAC = 4C:00:82:71:E6:40 BulkSync Status = Complete Average Redundancy Peer Reachability Latency = 428 Micro Seconds Average Management Gateway Reachability Latency = 2099 Micro Seconds Don't forget to change the network device address for the WLC in ISE. After I did this it still would not authenticate wireless users. I was getting this error for everything in the live log: 5441 Endpoint started new session while the packet of previous session is being processed. Dropping new session. I had seen a similar problem in the past though I can't remember what caused it. I restarted ISE and authentications started working again. I think there may be a command to clear the cache so that a restart isn't necessary but I am not sure what that is. So just thought this might help someone. I invite and welcome any improvements to this procedure. -Jeff
... View more
Labels:
07-01-2019
11:05 AM
Thanks Maestro. I was unaware of that command. This solution works in single context as well as multi-context
... View more
03-11-2020
Your suggestion is a little outside my comfort zone but I think I
somewhat understand what you are s...
03-09-2020
There are 30 - 40 firewalls.The goal is to maintain a single AD group
that governs access to network...
03-03-2020
I have a Windows forest with 4 domains. I want to authenticate a user
against DOMAIN-A and then chec...
02-27-2020
That was a great demo. Very informative But how about something like
this. I have several ASAs and I...
Created by
jedavis
in Small Business Support Blogs
01-21-2020
01-21-2020
Right, so lets compare two 8 port full power models
C1000-8FP-2G-LCatalyst 1000 8port GE, POE, 2x1G
...
Created by
jedavis
in Small Business Support Blogs
01-20-2020
01-20-2020
I see that there are 8 and 16 port models that have an external power
supply. But I can't seem to fi...
10-29-2019
Since upgrading from virtualized Prime 3.6 to 3.7 we are experiencing
frequent application hangs. I ...
10-22-2019
As far as I know replacement is the ONLY way to fix it is to RMA the
switch. But it would be nice to...
10-21-2019
The news is that I got a call at 5:00 AM this morning. One of my sites
in Germany had a power failur...
Created by
jedavis
in Network Management
10-04-2019
10-04-2019
I forgot to mention that I just upgraded to PI 3.7 hoping that the
search function would miraculousl...
Created by
jedavis
in Network Management
10-04-2019
10-04-2019
Where is the ability to search the configuration archive? Let's say, for
example, that I want to fin...
08-16-2019
I have seen this issue in all its various forms, whether relating to the
SFPs, the stacking modules ...
Created by
jedavis
in Wireless and Mobility
07-29-2019
07-29-2019
I changed the address on a pair of 5508's in HA mode this weekend. I was
unable to find a detailed p...
Public Statistics
| Date Registered | 11-07-2002 11:11 AM |
| Date Last Visited | 03-20-2020 12:07 AM |
| Total Messages Posted | 326 |
| Total Helpful Votes Received | 50 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
