Hi,   So we need to stage a wireless configuration in the UK before shipping to another country. This is using the UX flavour of access points. Is it possible to manually or automagically prime/provision the UX AP's within one country (UK) for another country (US) such that we can ship them out without an engineer?   All helpful comments rated!   Thanks! Ash. ... View more

Guys,   Struggling with ASA and SIP.   SIP inspection is enabled, and I have some NATs configured for a public Internet SIP service.   Inbound/outbound calls connect, but we are having 1-way audio (private to public ok, public to private nok)   This is because the SIP INVITE SDP header is using the private IP address of the handset, and the ASA is not rewriting it to the required outside public IP address.   What am I missing to get the ALG part of SIP inspection working?       ... View more

Hi Community, all helpful responses rated!   We have some Cisco ASA5550's running code release 7.2.4.   We are planning on upgrading these to 8.0 -> 8.2 -> 8.4 -> 9.0.3, step upgrade as proscribed by Cisco.   Now due to the nat-control and NAT syntax changes amongst other things, we intend to Proof of Concept this process in lab, review any unexpected behaviour and build out a test sheet.   My particular question relates to how the existing feature licensing is handled during the stepped upgrade process.   What will happen to our Security Plus license on 7.2.4 by the time we reach 9.0.3?   Many thanks, Ash. ... View more

Strange issue, not sure if anybody has seen this before. A new pair of 3850's in a stack. IOS XE 3.3.3SE, IP Services. AP's on switch 1and2 register ok. AP's on switch 1 advertise WLANs and service clients. AP's on switch 2 advertise WLANs but do not service clients. Checking the license right-to-use usage, only slot1(switch1) seems to have AP licences! Any guidance appreciated and rated!   ... View more

Hi community, We have upgraded our proof of concept ISE 1.2 lab to Patch level 2. Our lab design includes the use of external RADIUS servers which we off-load certain authentication rules to. To ensure resiliency of the external RADIUS service, we have two of these which we add to a RADIUS Server Sequence, the idea being that if the first in the list is unavailable, ISE will try the second and all will be well. Now this worked for us in testing ISE 1.2, but I have noticed that after the upgrade to Patch 2 ISE is sending the majority RADIUS traffic to the first (failed) external RADIUS server, with only the odd RADIUS Access-Request to thte next in the list. Anybody else come across this?? All helpful comments rated! Many thanks, Ash. ... View more

Hi guys, We are testing out ISE1.2 in the lab and are trying to achieve posture compliance assessment and remediation of Windows security patches with Windows clients running the SCCM Agent with SCCM 2012 infrastructure. Can you confirm whether support for SCCM 2012 is currently available for shipping ISE versions, or planned for a future ISE release? If this feature/integration is currently supported, could you point me in the direction of example configurations? All helpful replies rated! Many thanks, Ash. ... View more

Hi forum, We have an ISE deployment that we are lab testing. This is running v1.2.0.899 with Patch 2 installed. We have an authC policy configured for domain-joined computers for 802.1x and domain credentials:      Condition: Wired_802.1X      Allow Protocols: PEAP_CHAPv2      Use: AD This works, and authenticates both the machine (pre-login) and user (post-login). However, I am seeing some errors int the Auth logs before the 5200 Authentication succeeded message. These messages are not shown in the Cisco ISE Log Messages spreadsheet!     5441 Endpoint started new EAP session while the packet of previous EAP session is being processed. Dropping new session.     5405 RADIUS Request dropped     5440 Endpoint abandoned EAP session and started new Has anybody else exxperienced this or can explain why I am seeing this behaviour? All helpful responses rated! Thanks Ash. ... View more

Hi guys, We have ISE v1.2 running in the lab at the moment, and are intending to first deploy a Proof of Concept at two sites before a global deployment across four data centers and 150 Tier 1/Tier 3 sites. We will be deploying ISE for wired 802.1x for domain devices and MAB for trusted non-802.1x capable and guest devices ISE will be performing RADIUS proxy for 802.1x to Microsoft NPS servers using RADIUS Server Sequences. (I know ISE can do this but this was the design choice made by the business to meet certain requirements...) - DC sites will have a pair of PSN nodes (and separate PAN and MNT nodes in the top-level DC) and a pair of NPS servers. - Tier 1 sites will have a local PSN node and NPS server. - Tier 3 sites will use the regional DC PSN nodes and NPS servers. In order to ensure authentication requests are sent by ISE to the nearest NPS server, we are testing specific RADIUS Server Sequences that are called by specific Authentication policies that match a location (plus 802.1x auth) condition. We have quite a lot of these rules - 40 so far in the lab. My question is, has anybody built out a similar design, and what performance impact does ISE suffer by trawling through a long list of Authentication policies? How can we monitor this? I have optimised the Tier 3 sites at the top of the list (as these sites have no local ISE and suffer heavy latency to their regional DC). All helpful replies are rated! Kind regards, Ash. ... View more