Test trustsec in my lab.  Catalyst switch 3850 @ 16.6.7.  Client is authenticating via MAB.  Not seeing packets being tagged on the egress of the originating client switch.  CTS environment is populated and port is authorized via ISE.  SGT is assigned. I have CTS role based enforcement enable at the global and port level (but the switch does not indicate it)   <snippet from auth session> Server Policies: ACS ACL: Test-ACL-5b11bc70 SGT Value: 28   When I look at my CTS interface config, it shows disabled.  Is that correct?  How do I get that to say enabled? My switch port has no CTS configuration entries.   TestSwitch1#sho cts interface gi 1/0/24 Interface GigabitEthernet1/0/24: CTS is disabled. L3 IPM: disabled. CTS sgt-caching Ingress : Disabled CTS sgt-caching Egress : Disabled   A wireshark capture on the originating port shows an ether type of 0x800 not 0x8909.   What am I missing?           ... View more

Looking for creative ideas.  I have a customer with ASA/AnyConnect/Hostscan.  They are looking for ISE to replace Hostscan.  With Host Scan, the customer has one tunnel-group with two types of users connecting.  1) Corp User with Corp Device, 2) Corp User with Personal Device.  They also check for AV.  Authentication is done via username/password.  Customer not interested in Cert Auth. This all works but client ends up in a non compliant state and is indicated this in the AnyConnect client status.   With ISE and password auth, to check for Corp Device, I have to do via Posture since I don't believe I anything else to identify if it as a Corp asset in the authentication/authorization part. I know I can manipulate MAC address but that is not scalable for the customer.  I can do this via Tunnel Group isolation but the customer is not wanting to have multiple tunnel groups.  Hostscan is able to combine the corp asset registry check in as part of the session initiation.   I could use device name but I don't see that as a visible attribute in the live log summary.Are there any other ways to validate corp asset status in the Authorization phase?     ... View more

Looking for opinion. Have an ISE 2.3P5 customer that recently tried to turn up a dual SSID BYOD configuration for their Android users.  They had a difficult time with the implementation and ultimately pulled it out of service.  They stated that different Android devices/OS version had different behaviors when some would fail and some others pass.   Windows & IOS worked just fine.   Those of you that have deployed an Android BYOD network. Did you have difficulty deploying Android devices or did all go relatively smooth?   Thanks.   Sam ... View more

In the Performance and Scale document as well as the individual ISE version documentation, the only pxGrid scale measurement is the amount of subscribers a node supports (node size and deployment method).  I interpret a pxGrid subscriber to be an ISE Node, Stealthwatch, Firepower, Infoblox, DXL etc.  Should I be concerned about query or publish rates with a large number of Active and Passive authentications?  Will the numbers change with pxGrid v2 and ISE becoming a subscriber? ... View more

I am in the middle of a demo eval.  Currently we have ISE 2.4p5 set up for Context Visibility only.  We have only set up rules to authenticate one system (User/Machine Auth, Posture, No Profiling) We have DHCPSPAN enabled using a span port that sits in front of the DHCP server and the Internet.  We have discovered about 100k devices using DHCPSPAN and some Visibility wizard scans.  We have not done any nmap scans in about 30 days.  We are competing with another NAC solution that has only discovered about 40k devices using their discovery methods.  We are told we are not discovering their guest network and we confirmed that.  The customer believes ISE has phantom entries or is double counting bring it to the 100k count.   We have taken an endpoint export and we are analyzing the data.  I am looking to set up a purge policy to weed out any seen-once-and-gone devices.  I am worried that since I am not doing AAA, I will end up deleting legitimate endpoints from the DB.  Is there a condition that I can use that will allow me to delete endpoints that are no longer connected to the network?  Will InactivityDays work? Again, this is visibility only, no AAA enabled.   In the endpoint export, many machines do not have an 'Update Time' entry, Could I consider that as an option to purge devices from the csv file?  ... View more

ISE works with Tenable for Vulnerability Assessments (VA) when a device connects.  I want to clarify a few things about the feature.   1) Can Tenable also send threat notifications to ISE for threats discovered from a regularly scheduled scan to cause a quarantine CoA (Rapid Threat Containment).  This would not be alogin event 2) Can VA be done as part of a periodic reassessment?  Not asking should I do it.  Asking, can I do it. 3) Can the VA feature be used for IOT devices?  It doesn't say any OS restrictions but want to double-check.   Thanks. ... View more

Experience during a PoC  Customer has roughly 3000 LAN switches that sit on a common VLAN per campus site.  At some large locations there are upwards of about 60 switches on one subnet (e.g. 10.100.1.0/24)  We were using the Visibility Wizard to discover the 30k endpoints in their network.  In the beginning of the wizard we put the 10.100.1.0 network in the network device discovery wizard.  After running just the network device discovery the results only returned 12 switches even thought there were a lot more on the subnet in the same building.   If we run it again, only 1-3 more devices would show up.  We could never get more than 15 devices discovered.    Is there a limit on the number of network devices that can be returned in a search?  SNMPv3 values were all correct and we believe we had no discovery failures.    Second question.  For discovery purposes only, can you start another Visibility scan immediately after you wizard-complete the first one. Will ISE be able to run two or more Visibility network scans at the same time (staggered overlapping)?   Third question, we also saw NMAP scans for devices that were not in our specified subnets.  For example, we set the visibility wizard up to scan the 10.120.1.0 network.  When running a tail of the Nmap.log file we saw that nmap was scanning other networks such as 10.5.0.0 or 10.21.1.0.  This ISE is doing no authentication/authorization.  The only other thing we have configured is a DHCP/HTTP SPAN. Would nmap automatically be scanning the devices that were learned via those probes?   I have not been able to find any detailed documentation on the Visibility wizard.  Pointers would be welcome.   ... View more