Hi,   I am having an issue and more specifically on Windows 10 PC`s. The Anyconnect VPN and NAM modules were initially deployed to a few windows 10 computers through GPO. However, it is not possible anymore to upgrade or completely uninstall and re-install new Anyconnect client software.   For windows 10 devices where a manual installation has been done (i.e not GPO), I can install, uninstall and upgrade the software with no problem at all. The problem is only related to Windows 10 devices that have the client installed through Group Policies.   Does anyone have an explanation for such a behaviour or have you experienced it? The only fix requires going through all Anyconnect registry keys on the system and deleting them. However such an action would not be the preferred option on a multitude of devices.   Thanks for any suggestions.      ... View more

Hi Guys,   I have an ASA 5585-SSP-SFR-60 running in multiple context mode. I have setup the ASA to redirect only specific traffic to the FirePOWER module by configuring bidirectional access lists with a deny statement for the specific flows i wish not to inspect and an ip permit any any at the end of the ACL to permit all the rest.   What i find odd is that there is a hit on these ACL`s that have this deny statement when i do a show access-list <ACL_name> but the traffic shows up on the FMC dashboard in the connection events when i filter on the specific source and destinaion traffic that i wish to exclude from FirePOWER . I do not expect to see such traffic showing up as i am not redirecting it to FirePOWER based upon my bidirectional deny statement. .   On the FMC, I also observe that traffic on the connection events is from the context that i have this conifugration running, So i am quite confident that the configuration set up on the right context   Would there be any specific reason for such a behavior? I am running ASA software version 9.6(3)1 and FirePOWER 6.0.1.3   Has anyone run into a similar behaviour?   Many Thanks   Alain ... View more

Hello, I have Windows 10 machines and i am trying to deploy Wired 802.1X for both machine and user authentication as clearly explained on the below link http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_80_eapchaining_deployment.pdf I also have Cisco NAM supplicant 4.3 installed on end user devices and i am using EAP-FAST for authentication of users. The problem is that it is kind of a hit and miss at the moment, It works sometimes, sometimes not. Surprisingly, I am prompted to re-enter credentials on the Cisco NAM client and i am still not able to authenticate using the right user credentials. I notice on the Cisco ISE radius logs that sometimes the windows machine sends the wrong username to ISE which results in authentication failure. The machine mac address is sent or anonymous as a username. Does anyone have a solution on better way to deploy Wired 802.1X for Windows 10 using Cisco NAM and ISE 2.0? The most surprising is it does work sometimes and sometimes not. I also tried using Windows native supplicant and still not successful. I did run a few Wireshark traces on the test machine while authenticating and it looks like the PC is submitting the right username, but to my surprise the ISE logs show a failed authentication message for the username anonymous. I tried fine tuning the xml configuration file for NAM thinking it would be a problem, but no luck with that. Any help or guidance or is very much appreciated ! For Wireless 802.1X using ISE 2.0 as a radius server and the NAM supplicant on Windows 10, all works with no issues  Thanks in advance for any help on this ! ... View more