Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Damien Miller
Damien Miller
Member since
06-18-2012
.jpg){kind=icon}
VIP Engager
A misplaced Canadian living in the Arizona desert with a wide array of Cisco certs. During the day, and the night too if we’re being honest, I am a consulting Network and Security Architect for one of Cisco's largest VAR's. I help clients of all sizes with their networking and security needs, specializing in large scale ISE and TrustSec environments.
07-22-2019
11:31 AM
I don't want to step on any toes, but you are correct, you do not need 256 GB VM's for a distributed deployment. There might be some confusion there if they are referring to the 3595 as the large VM which at one point in the past it was.
A distributed deployment has been tested and is supported using medium or large VM's for the PAN and MNTs, slight variation based on the version you deploy, 2.4 vs 2.6.
You are good to run 4x 3595 for pan/mnt's, or 4x 3655/3695.
... View more
07-22-2019
07:57 AM
If your max active sessions will be up to 20k but not over, then you require 3595 or 3655 sized appliances (Medium). You can support 20k active on a standalone or hybrid 3595 deployment, and 25k active on a 3655 deployment. If you need to have 8 PSN's, you should really have a 12 node deployment. 2x admin, 2x monitoring, 8x psn. The Admin and MNT's should be medium sized nodes, while the PSN's could potentially be small 3515 or 3615's. Each 3515/3615 will support 7500 or 10000 active sessions respectively. This is of course strictly an active session count picture, there are more detailed authentication type limits documented. I suspect you won't hit the session auth per second limits that are published unless you host large events and are peaky. This is of course all documented in the community scaling guide. https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148
... View more
Created by
Damien Miller
in Policy and Access
Damien Miller
in Policy and Access
07-17-2019
07:46 AM
07-17-2019
07:46 AM
You need to define a repository named local, if you issue a "show repository local" does it tell you the repo isn't found? You can define a disk: repository from the CLI or GUI. If you issue a show run, you are looking for this. ! repository local url disk:/local/ !
... View more
Created by
Damien Miller
in Policy and Access
Damien Miller
in Policy and Access
07-15-2019
09:12 PM
07-15-2019
09:12 PM
The last time the session ran was 2016 Berlin, this is one of the downsides of Cisco Live content, they drop the old yet still relevant sessions. In this case, What's new in ISE Active Directory connector - BRKSEC-2132, only has two left. This link will work for about a year and a half. https://www.ciscolive.com/global/on-demand-library.html?search=BRKSEC-2132#/session/14525434149870017MRf
... View more
07-01-2019
06:44 AM
So 150k would be the upper tested limit then? It's currently 50k, but that will easily be 600k+ next year if Kerberos doesn't pan out.
... View more
06-25-2019
11:58 AM
I was on the fence if this should go in to the ISE category or WSA, but because it's platform specific to the WSA I settled on here.
I wondering what is the maximum number of IP-SGT bindings the WSA platforms can support. I have a customer that has an existing ISE/PXGrid WSA integration leveraging TrustSec IP-SGT bindings for internet access. They are relying on this integration quite heavily across their WSA's and we are looking at scaling the ISE environment. This expansion means a lot more than the existing 50k IP-SGT bindings.
It's not listed in the TrustSec system bulletin so I wonder what's been tested. I'm worried we are going to hit a show stopping limit as the roll out continues and I would like to get in front of it.
The ask is specifically what the max ip-sgt bindings we can learn via pxgrid on s670/680/690 hardware before we pass any limits.
... View more
Labels:
06-20-2019
08:37 PM
If you follow the documented password reset process and don't rerun the install, then your config will remain untouched.
... View more
06-11-2019
07:49 AM
It sounds like your default policy/SGACL is to deny unknown aka tag 0. In that case it would be working as designed. You could change the default from deny all to permit all. If you look at the bottom of the TrustSec matrix in ISE, is the default below the table permit all, or deny all? https://<ise pan ip>/admin/#workcenters/workcenter_trustsec/workcenter_trustsec_policy/egress/matrix
... View more
Created by
Damien Miller
in Policy and Access
Damien Miller
in Policy and Access
06-01-2019
11:22 PM
06-01-2019
11:22 PM
Leveraging the packet tracer functionality could be a huge help for you here. If it is a config issue then it should indicate which step along the way is causing the drop.
... View more
05-31-2019
09:35 PM
Yes .tar.gpg is the correct backup file format. The file is a GPG encrypted tar bundle, and it is encrypted with the key you specify on the backup config. You can decrypt the backup on windows with a tool such as GPG4Win. Now having never decrypted a backup file myself, I'm not certain what format you will find the "config" in. Doing the same thing with gpg encrypted support bundles presents text log files among other human readable content.
... View more
05-28-2019
04:26 PM
To clarify here, you will not be able to auto generate the report and send it by email, it has to be exported to a configured repository. Only the notification that the report was run and exported can be emailed.
... View more
05-28-2019
12:18 PM
Can anyone confirm for me if the 3.6.x train supports UPOE on the 3850? I can't find specific mention in the documentation stating UPOE requires a minimum release train. I just remember someone once mentioning to me that 3.7.x did not support UPOE. I would like to clarify any misconception or uncertainty I have.
... View more
Labels:
05-18-2019
06:29 PM
It's fine to do this so long as you consider SGT scale in your environment. Hardware platforms have a total number of unique endpoint SGT's that they can handle at a given time, and ISE has a 10k limit that I wouldn't want to get anywhere near. Managing to SGACL policy matrix at that size would be brutal. If these are static IP endpoints and it's a one off thing, a standard ACL would still probably be my choice.
... View more
05-16-2019
04:55 PM
There are two ways to approach this, will it run vs what's been tested and published. In regards to #1, 2.4 has not been given the green light to run on 3600 series VM templates and will not run on 3600 appliances today. Seeing as you're internal, you could talk to ISE PM for more insight on this topic. On #2, 2.4 will certainly run on a 3655 VM template since it is just RHEL Linux underneath. It will boot, install, and generally not care if it has more resources. I would suspect that VM license warnings would occur though since 2.4 would probably consider a VM larger than 64 GB a large node. But no one is stating that it will support 50k endpoints and if TAC was involved in troubleshooting they would likely ask for the VM template to be corrected. Depending on the timelines, building this with 2.6 and 3600 scaling in mind could be beneficial. 2.6 is the next long term support release for ISE, and while 2.4 is considered mature and currently being recommended, that will eventually move to 2.6.
... View more
12 hours ago
I don't want to step on any toes, but you are correct, you do not need
256 GB VM's for a distributed...
16 hours ago
If your max active sessions will be up to 20k but not over, then you
require 3595 or 3655 sized appl...
Thursday
Reloading the primary MNT should clear these, it would at least be a non
impacting step you could tr...
Thursday
If you are a Cisco employee you can use the internal page
http://cs.co/ise-pm to discuss with the pr...
Created by
Damien Miller
in Policy and Access
Wednesday
Wednesday
You need to define a repository named local, if you issue a "show
repository local" does it tell you...
a week ago
The last time the session ran was 2016 Berlin, this is one of the
downsides of Cisco Live content, t...
Created by
Damien Miller
in Identity Services Engine (ISE)
a week ago
a week ago
If you plan on recreating much of that you are leaving behind, a restore
would be an easy time savin...
a week ago
You do this through the Context Visibility > Endpoint gui page. There is
an import button there that...
a week ago
2.4 patch 2 fixed an issue where the static identity group mapping could
be dropped when we received...
a week ago
Is that true even if one was to add "access-session monitor" to the
global config? Maybe I misunders...
Created by
Damien Miller
in Identity Services Engine (ISE)
a week ago
a week ago
That agrees with how I feel the command/feature should work. I'll
continue to work the TAC case and ...
Created by
Damien Miller
in Identity Services Engine (ISE)
a week ago
a week ago
I've been developing and testing some new IBNS 2.0 configurations on a
3850 with 16.6.6/16.9.3a and ...
2 weeks ago
Look up SR# 686558774 if you have access to it, similar sized from NADs,
on 2.4, and primarily TACAC...
Public Statistics
| Date Registered | 06-18-2012 08:33 AM |
| Date Last Visited | 07-22-2019 11:32 AM |
| Total Messages Posted | 750 |
| Total Helpful Votes Received | 1103 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
Awards
Cisco Designated VIPs
2019 ISE
