Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Ahmad Murad
Stats
Member since
04-03-2012
63
Posts
8
Helpful
2
Solutions
Created by
Ahmad Murad
in Policy and Access
in Policy and Access
08-31-2015
05:22 AM
08-31-2015
05:22 AM
Hi, I'm trying to install Cisco NAC Agent silently using the following "msiexec" line: msiexec.exe /i nacagentsetup-win.msi /qn /l*v c:\temp\agent-install.log The installation works fine, but is there anyway to remove creating the desktop/start menu shortcuts from the setup as I want the setup to be transparent at all for all the users (no desktop shortcuts, no start menu shortcuts). I tried all the combinations like: INSTALLDESKTOPSHORTCUT=0, and DESKTOPSHORTCUT=0, but with no luck. Is it hard-coded on the NAC Agent MSI that the shortcut will be created, or is there anyway to remove this? Thanks. Ahmad.
... View more
Labels:
06-02-2015
07:56 AM
Hi, I'm deploying ISE for wired and wireless infrastructure using the software version 1.4. (it was 1.3 Patch 2 and I upgraded it to 1.4). Once we upgrade the deployment (2 nodes), we are facing issues with client provisioning and NAC agent pop-up on Windows 7/8/8.1 The problem is like the following: 1. Windows machine authentication using MAR. 2. User authentication against the AD. 3. If you open the browser, you will be redirected to the client provisioning portal to install the NAC agent. 4. You click on the "start" button to start the process, but after that you get an error "Contact your help desk for assistance". 5. The operations tab shows that everything sent to the SW correctly, and even the session is OK. 6. Sometimes it works, and we can download and install the NAC agent (4.9.5.7) and it will pop-up and check the PC. 7. If we restart this PC, the problem happens again and we stick again on the same loop. 8. The client provisioning report shows that this username/MAC address fails because of the following reason: Error while trying to determine access privileges: No matching SPW profile found 9. The weird thing that it may work after multiple tests without any changes on the ISE/SW/PC, and the same report shows the correct CPP match. 10. The deployment was working fine and tested multiple times using software 1.3 Patch 2, and we are facing this issue after the upgrade to 1.4. Any idea or similar case about this behavior?
... View more
- Tags:
- ise 1.4 1.3 upgrade
Labels:
06-02-2015
01:21 AM
Check if the port is open on the ISE by checking the command "show ports" on the CLI. Alco, check that the certificate setup is correct.
... View more
09-20-2014
12:40 AM
Unfortunately, you need first to create a CSR with wildcard filed either on the CN or DNS fields, and then you need to sign this CSR from the CA using the exact same values and bind it again to the CSR on the ISE configuration.
... View more
09-19-2014
09:32 AM
Did you check if you add an ACL on the interface (switch port) like the following: ip access-list extended ACL-TEST permit udp any eq bootpc any eq bootps permit udp any any eq domain permit udp any any eq tftp deny ip any any log interface g1/0/x ip access-group ACL-TEST in and then from your ISE configuration (Authorization Profile), you can over write the applied ACL on the physical interface, with DACL (like permit ip any any), and check if this will work?
... View more
09-19-2014
09:26 AM
Hi, In order to create CSR file from the ISE using a wildcard certificate, you can do the following: From the CSR page, enter the CN=*.yourdomain.com and If you have a specific DNS entry for your ISE like ise1.yourdomain.com under the SAN fields. Also, you need to check the box of "Allow Wildcard Certificate". After that, you can generate and export the CSR and submit it to your CA to get the ID certificate (which you will bind it with the CSR). Also, you need the CA certificate itself to be added on the ISE certificate store. Thanks. Ahmad.
... View more
08-17-2014
04:07 AM
The only option you have is to remove the administrator passwords expire option from the GUI, or you can increase to the maximum limit which is 3650 days. Once you un-check the box from the settings, then also it will be removed from the CLI configuration.
... View more
06-11-2014
02:53 PM
Do you still face the error message appears on the NAC agent that the OS is not supported? If yes, then you need to know the exact version of your Windows 8/8.1 machines. Can you please submit here a snip of the error message along with System Properties from the machine facing the problem? Thanks. Ahmad.
... View more
05-21-2014
09:33 PM
According to this tech-note from Microsoft, this is how Windows detects Internet Connectivity: http://technet.microsoft.com/en-us/library/ee126135%28WS.10%29.aspx So in general, you need to have port 80 or DNS open to the listed website/DNS record. Now, did you try to refresh the IP and see if you face the same issue? Thanks. Ahmad.
... View more
05-06-2014
02:34 PM
Try to remove the module and add it again on the same slot or in different slot, if that does not help, then you need to RMA the module if you have valid support from Cisco.
... View more
05-05-2014
10:43 PM
You can use the LWA on the controller, since it will redirect the successful logins to pre-defined page on the configuration. For the CWA, still this feature is not available.
... View more
Created by
Ahmad Murad
in Other Network Architecture Subjects
in Other Network Architecture Subjects
05-01-2014
05:19 AM
05-01-2014
05:19 AM
Hi, I suggest moving this question to the AAA section. Changing the NTP servers on the ISE nodes (especially the PSNs) will restart the application process of the node, and then you cannot authenticate any wireless users. So if you need to change the NTP configuration, I prefer to make it on downtime or when you have minimum wireless users authentication. Thanks. Ahmad.
... View more
04-15-2014
02:11 PM
If you need to access the inside interface for management through the VPN, then you need: "management-access inside" command, in order to ssh/telnet/http to this interface through the AC. For the outside interface, you need to check the configuration of split-tunneling, so if the outside subnet is excluded from the tunnel, then you can connect to the ASA using the normal ssh command. Thanks. Ahmad.
... View more
Created by
Ahmad Murad
in Policy and Access
08-31-2015
08-31-2015
Hi,I'm trying to install Cisco NAC Agent silently using the following
"msiexec" line:msiexec.exe /i ...
06-02-2015
Hi,I'm deploying ISE for wired and wireless infrastructure using the
software version 1.4. (it was 1...
06-02-2015
Check if the port is open on the ISE by checking the command "show
ports" on the CLI.Alco, check tha...
09-20-2014
Unfortunately, you need first to create a CSR with wildcard filed either
on the CN or DNS fields, an...
09-19-2014
Did you check if you add an ACL on the interface (switch port) like the
following:ip access-list ext...
09-19-2014
Hi,In order to create CSR file from the ISE using a wildcard
certificate, you can do the following:F...
08-17-2014
The only option you have is to remove the administrator passwords expire
option from the GUI, or you...
06-11-2014
Do you still face the error message appears on the NAC agent that the OS
is not supported? If yes, t...
05-21-2014
According to this tech-note from Microsoft, this is how Windows detects
Internet
Connectivity:http:/...
05-06-2014
Try to remove the module and add it again on the same slot or in
different slot, if that does not he...
05-05-2014
You can use the LWA on the controller, since it will redirect the
successful logins to pre-defined p...
05-01-2014
Hi,I suggest moving this question to the AAA section.Changing the NTP
servers on the ISE nodes (espe...
Public Statistics
| Date Registered | 04-03-2012 02:10 AM |
| Date Last Visited | 08-18-2017 04:03 AM |
| Total Messages Posted | 63 |
| Total Helpful Votes Received | 8 |
