I do not know the reason behind the policy set changes in 2.3, I'm working on ISE since the very first release, this was the worse change I have ever seen so far on ISE. I did not like at all. ... View more

The user is already logged in when the PC comes back from sleep .I did not notice the status of the anyconnect  if it is searching or something when the user logged in to the machine.I have to re-check again , but apparently there is an issue between sleep mode and anyconnect.  when comes back from sleep mode , anyconnect could not be detected by ISE (or the other way around) , and therefore this machine will be seen by the ISE as it dose not have anyconnect installed. This is what we have to find a solution for.     ... View more

Hello Jan, The problem happened again , to answer your questions : - Does ISE authenticate your machines once they "wake up" and then sends an authorization result? after the machine wake up , ISE authenticate the machine , but the authorization profile given is the one given when the machine do  not have anyconnect installed (CPP) in my case this authorization profile named "XYZ-ISE-POSTURE-UNKNOWN" - What authorization attributes are you sending to the switch, vlan change, acl or both?   When machine is authenticated and authorized , ACL list is pushed to the switch. no vlan change. - What host mode are you using on the switch ports ? ( maybe post interface config)   host mode multi-auth - What does a "show auth sess interface <port the pc is in> when it's ok, and when this problem is happening (before the manual reconnect)? when the problem happens and before disconnect and connect  : ===================================================== ZI-IT-021#Show auth session int  gig1/0/11             Interface:  GigabitEthernet1/0/11           MAC Address:  fc15.b4ec.f432            IP Address:  172.16.21.8             User-Name:  z8785                Status:  Authz Success                Domain:  DATA        Oper host mode:  multi-auth      Oper control dir:  in         Authorized By:  Authentication Server           Vlan Policy:  N/A               ACS ACL:  xACSACLx-IP-XYZ-ISE-POSTURE-UNKNOWN-55ebe7ee      URL Redirect ACL:  ACL-REDIRECT          URL Redirect:  https://XYZ-ise-01.xyzq.net:8443/portal/gateway?sessionId=AC10321500016725166C9573&portal=bd13d762-fd2c-11e4-a063-b83861d7efc6&action=cpp&token=acbfea3c5e84d2d7e3cbff8c72c23b47       Session timeout:  N/A          Idle timeout:  N/A     Common Session ID:  AC10321500016725166C9573       Acct Session ID:  0x00019575                Handle:  0x510006E0 Runnable methods list:        Method   State        dot1x    Authc Success        mab      Not run ====================================== After disconnect and connect ====================================== XXIT-021# 917334: Oct 20 2015 10:47:24.538 KSA: %DOT1X-5-SUCCESS: Authentication successful for client (fc15.b4ec.f432) on Interface Gi1/0/11 AuditSessionID AC10321500016725166C9573 917335: Oct 20 2015 10:47:24.538 KSA: %AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (fc15.b4ec.f432) on Interface Gi1/0/11 AuditSessionID AC10321500016725166C9573 917336: Oct 20 2015 10:47:24.538 KSA: %EPM-6-POLICY_REQ: IP 172.16.21.8| MAC fc15.b4ec.f432| AuditSessionID AC10321500016725166C9573| AUTHTYPE DOT1X| EVENT APPLY 917337: Oct 20 2015 10:47:24.545 KSA: %EPM-6-POLICY_APP_SUCCESS: IP 172.16.21.8| MAC fc15.b4ec.f432| AuditSessionID AC10321500016725166C9573| AUTHTYPE DOT1X| POLICY_TYPE Named ACL| POLICY_NAME xACSACLx-IP-XYZ-PERMIT-ALL-547d7b63| RESULT SUCCESS 917338: Oct 20 2015 10:47:25.289 KSA: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (fc15.b4ec.f432) on Interface Gi1/0/11 AuditSessionID AC10321500016725166C9573 XXIT-021#sh authentication sessions int gigabitEthernet 1/0/11             Interface:  GigabitEthernet1/0/11           MAC Address:  fc15.b4ec.f432            IP Address:  172.16.21.8             User-Name:  z8785                Status:  Authz Success                Domain:  DATA        Oper host mode:  multi-auth      Oper control dir:  in         Authorized By:  Authentication Server           Vlan Policy:  N/A               ACS ACL:  xACSACLx-IP-XYZ-PERMIT-ALL-547d7b63       Session timeout:  N/A          Idle timeout:  N/A     Common Session ID:  AC10321500016725166C9573       Acct Session ID:  0x00019575                Handle:  0x510006E0 Runnable methods list:        Method   State        dot1x    Authc Success     as you can see , it looks like when the machine comes back from sleep mode , the Cisco Anyconnect can not be detected by ISE .    Any ideas ?!       ... View more

Hi Jan ,   Thanks for your reply , Actually these two issues happened randomly , sometime it works and sometimes it did not . I have regenerate the problem or wait until it happened again and I will capture the outputs from the switch side and ISE side and post here .   port configuration is as follows : interface GigabitEthernet1/0/1  switchport access vlan 121  switchport mode access  switchport voice vlan 130  authentication event fail action next-method  authentication event server dead action reinitialize vlan 121  authentication event server dead action authorize voice  authentication event server alive action reinitialize   authentication host-mode multi-auth  authentication order dot1x mab  authentication priority dot1x mab  authentication port-control auto  authentication periodic  authentication timer reauthenticate server  authentication violation restrict  mab  snmp trap mac-notification change added  snmp trap mac-notification change removed  dot1x pae authenticator  dot1x timeout tx-period 10  spanning-tree portfast  spanning-tree bpduguard enable   2- For the second issue : the machine was already complaint , and this happens when re-posture is happening , the machine need no remediation as it is already complaint . Posture check includes AV check and some services check and it is all OK with that machine. It is just annoying the user and he is asking why it is doing that from time to time , sometimes it happens fast , and sometimes takes long time to complete. I will gather more information about this issue and post it.           ... View more

Thanks for your reply , I know what's MAB , if you read my explanation again , i mentioned that the user is authenticated in the guest portal which mean that I have web authentication , and it is working fine .. The only issue is that I can not use the vendor1 username as part of authorization condition and this is because the switch is not sending the radius attribute type 1 to the ISE , thus , on the ise authentication log the MAC address  of the client machine is shown as a username not the actual username ( vendor1)  as I mentioned also , I have exactly the same setup with ise 1.2 and 3750 switch and I do not have this issue .I experience this with 2960x only .          ... View more

Hi Charles  in my case , it is wired and it is two nose deployment not distributed . ise 1.2.1 with last patch  url redirection is working fine , supplicants provisioning is ok , device registration is also fine .  But after the user login he is redirected again to the portal .. The device is shown under registred devices , but the autho rule 2 is not being hit after user login .. The strange thing is that when I try again , the device registration portal ask again to register .. Although the device is under registred devices ... i have no clue what's going on.,     ... View more

Hi Patrick, I'm facing similar problem as yours , but on wired . My contractor (I name it vendor) is redirect to guest portal , and when they login they were redirected to the portal again. for the devices registration , I have set  the Native Supplicant Provisioning Policy Unavailable: to Allow network acces.  my authorization rules as follows : 1- rules name : Vendor-wired  :  identity : registerddevices AND identitygroup: VENDOR  authorization profile: VENDOR-ACCESS 2-  rules name :  WIRED-CWA  :  identity : any   condition: device-type:SWITCH  authorization profile: CWA-PORTAL It looks like , when vendor is login , they are not hitting the first rule , although the device shows up in the registered devices , and the vendor account is in VENDOR identity group (local in ISE) , so they come back again to rules 2 , which redirect them to the CWA-PORTAL again . did you find any hint for this problem ?           ... View more

Hi Mohammed, I just saw your discussion , and it looks interesting .. I'm using this redirection ACL: ip access-list extended ACL-REDIRECT     deny ip any host ise1    deny ip any host ise2        permit ip any any  my problem is that the NAC agent does not pop up when the user login , on the client machine , I can resolve the ise ip , and if I use the redirection acl directly on the client browser it to goes to the ISE ccp portal .. have you face the same issue when you use this redirection ACL?   ... View more