I haven't read through it yet, but part of the problem with these unauthorized Apple clients, is that they don't have NAC Agent installed. All of our Windows clients do. So would this ISE configuration mentioned aboive have any affect, woudln't Anyconnect just ignore anything ISE said without the NAC agent installed?   I know there is also something in (or a part of) Anyconnect that can do the ISE posturing instead of using NAC Agent, but I haven't made it that far in configuration of ISE (I'm also in the throws of rebuilding ISE to v2.3 from our current 1.4).   ... View more

Statements/Issues/Questions like this are unfortunately VERY common. I think the largest cause is how Cisco 'plays it close to the vest' on the more detailed information. And that is probably because they don't want just anyone to jump into potentially VERY important (and business critical) configurations and cause even larger problems potentially for everyone. (or maybe they just want the additional income from requiring anyone that wants to know how to work on these things to get a certification). At any rate, I promise configuring ISE from scratch is very doable....IF you have time to spend and an environment that will allow you to learn. I started out with ISE 1.1, the company we worked with to get it implemented assigned us a Cisco expert that seemed almost as green as me when it came to how to actually configure ISE for our setup. I feel that I pretty much learn it all on the fly during that implementation and almost on my own. I did not have time to do so, nor did we have an environment that allowed me the luxury of 'playing to learn'. My company wanted this implemented and did not give me 'warm and fuzzies' for any delays or issues we had. We are now running on ISE v1.4u? born from this original implementation. I actually have ISE v2.2 running on our HyperV cluster (but having network related issues specific to talking to ISE), because we implemented an MDM solution that required v2.2 to work properly. So now I also need to convert/migrate our rules from 1.4 to our 2.2 (and quickly, I only have 30days left of our 90 trail). It is NOT easy, but if you have the ability, I suggest diving head first in getting to know it. Read up, read older version docs, to get a feel of how operations have changed and how the product has improved (or got worse). Read through all the forums you can find, I still feel like I have a LOT to learn and I have been working with ISE for 5 years now. You can go back and look at some of my posts here to see some of my struggles. ... View more

This worked for me in Win10 also!! Why is this not either corrected by the Cisco Installer after all this time? Or not a part of the documentation/troubleshooting documents?!?!? ... View more

No solution, other than to replace the hardware. What we ended up doing was giving our SmartNet contractor both the hardware serial and the serial we got from the SHOW VERSION command. ... View more

This would be a setting within ISE or NAC Appliance, telling your endpoints to check during a network change. So if you change from LAN to Wifi, or change from one Wifi to another WiFi. ... View more

Working with Cisco, I did discover that at least on the latest version of NAC Agent it attempts a DUMMY check to 1.1.1.1, to try to kick itself into action. So we had allow 1.1.1.1 across the VPN tunnel so that NAC would actually pop up and check in to the actual defined discovery host on the inside of our network. Where do you see this enroll.cisco.com being used? For the redirect to the ISE portal for those that don't have NAC agent, we were able to figure that out, by what we are allowing across the VPN tunnel....using the documentation for enabling the ASA to do CoA without the IPN, the access list in that document solved the redirect, but only if the user tries to access an internal webserver on port 80. ... View more

Wow, an entire month and nothing? Well I am here to tell everyone, do not tread into this transition lightly. I have worked with TAC slowly over the last couple of months to make sure this was a straight forward and easy transitions, but I am disappointed to say, I have been bitten by the complexity that this change makes to our configuration. First of all, if you are using Split-tunnel on your RA-VPN, DO NOT go by the instructions in TAC Doc#117693: ASA VERSION 9.2.1 VPN Posture with ISE Configuration Example. (First order of business that I take issue with is, the entire document mentions nothing about a VPN ACL (split tunnel or otherwise) and does nothing to describe how such an ACL would be overridden by ISE. It just has you create an ACL ('Redirect') on the ASA that is not assigned to anything, then in the ISE configs tells you to tell ISE to call on that ACL at some point. It took me hours of working with TAC to get my split-tunnel config working correctly before we even started reworking the ISE side of the config. And now we are sort of in limbo with our VPN users because at this time anyone that connects to the VPN has full internal network access even before the NAC agent pops up to start the posture process and it stays that way, pass or fail. We currently have Cisco jumping through hoops to get this config solved. In general I think that if we didn't use split-tunnel things would be much smoother on this, but things as they are, we are unable to change that. Working with TAC we can clearly see on the ASA that the dACL is being pushed to the VPN users, but it seems the split-tunnel ACL from the original VPN connection is forcing precedence over any ACL pushed down from ISE. ... View more

Can you elaborate more on your fix? ... View more

No, this has not been 'fixed' we still have to manually point users to the NAC install or just manually install NAC, it won't redirect for split tunnel users. ... View more

Ok, so I have 3 ASAs (2x 5515X and one 5505) The 5515X are running 9.4.1(3) (ASDM 7.4(3)), the 5505 is running 9.2(3).3 (ASDM 7.4(2))   I didn't see this issue on my 5515X systems, but my 5505 did throw the error about not supporting RSA 4096 for SSL.     ... View more