hi Daniel, Could you please tell us the main differences between Cisco ACI & VMWare NSX, and how ACI could be a better choice? thanks, Kevin ... View more

That worked; forgot the good old way to save a web page. Your input in this thread has been awesome. I took your ISE session in San Fran back in May, and you were great there too.   ... View more

Does anyone know how to save this thread (or any other thread) as a file on my local drive? There's some really good case studies & info that I want to reference later on. When I click on the "Save" towards the right hand side of the page, it automatically generats a PDF file, but it only contains the first page. When I straight up print this web page in browser, all the formatting gets messed up, and the contents are hard to read.   ... View more

hi Craig, Thank you for the reply to my previous question. As a higher education operator, we allow any anti-virus software, as part of our posture assessment check. So on our current Cisco NAC manager, under User Management / User Roles / Temporary Role / Host, there's a long list of URL's as "Allowed Host", where users can go, to get their AV software installed/patched to be complianed. For example: .mcafee.com, .symantec.com, .trendmicro.com, etc. How can we migrate this function to ISE? A few more recent platforms support DNS based ACL, but most of our Cat2K switches don't. There are ~50 entries on that list. Any way to support it on ISE w/o having to manage an ACL that's based on IP's? Ditto for allowing access to Google Play to onboard Android devices. Thx, Kevin ... View more

hi Craig, We currently utilize Cisco NAC (Clean Access) to perform posture assessment, to make sure the endpoints have proper anti-virus software/definition, and up-to-date Windows patches. What's your take on posture assessment? Is it still a good investment in today's environments? We're torn between continuing doing posture, or only doing authentication when we migrate to ISE. We think it's a good idea to do posture, but it's a hard sale to management because of the premium Cisco charges for Advanced/Apex-AC licenses, and the technical complexity it brings. Does Cisco have more customers doing posture than those not doing posture? If you had to guess, what's the percentage breakdown between the two, in general, and in higher education? I'm guessing most Fed/SLED customers would want to do posture, but I'm interested in knowing what other colleges & universities are doing. Thank you, Kevin ... View more

hi Peter, Thanks for the reply. I know this is a tough issue, which is why GSS also includes other mechanism to influence the load balance decision, such as RTT in ICMP reply, to see which datacenter is closer to the endpoint. This still doesn't solve the issue at hand, which is a mapping between IP & physical location. Very interesting find on the two RFC's that actually allow us this ability in the past 10 years, but nobody's using it. Wouldn't it be scary, and useful at the same time? It's scary because if the ISP's were to populate the GPOS, or LOC records in DNS for the IP's that they assign to their customers, nobody would be anonymous anymore, when they browse the web. It would be very easy for people to find where your home is, and use it for malicious purpose. (unless of course, you go through a VPN/proxy) It's useful because law enforcement can locate exactly where the bad guys are w/o asking the ISP's, if they're dumb enough to leave their trail on the Internet. It could also be useful for e-commerce...imagine you never have to key in your ship-to address again. The Amazon shopping cart automatically populate the address field for you, w/o having to set up an account. I always turn off location services on my iPhone by the way... Kevin ... View more

hello Peter, Nowadays the source IP no longer represents the actual location of the endpoint. You can have an IP range obtained from RIPE advertised in the U.S. Many GSLB products that work in conjunction w/ DNS, such as Cisco's GSS, rely on the IP-to-location mapping to provide geo-location information. How do you think people can work around this caveat? thanks, Kevin ... View more

hi Joseph, Thank you for the reply, and you pointed out some very interesting things that we weren't aware of. Is there a document or link you could forward to me, so that we can do more research on? Most Cisco CCO doc's, including the SRND Medianet QoS design guide, only touch on how to configure WRED, and when WRED would drop packets (Mean queue depth > Min/Max threshold), but not the things you mentioned in detail. In your experience, is it fair to say performance is actually better without WRED, for most of the common use cases? (I know it's impossible to use one formula for all cases) To answer your question, most of our app's are TCP based, so we don't have class-map's/queues that are dedicated for TCP, or UDP. (of course VoIP bearer gets its own priority/LLQ queue) Although a few class-map's may have certain tcp ports as the matching ACL creteria, so in a sense, that particular queue would only contain TCP packets. We don't have flow-based RED for the same reason (not much UDP traffic), but if you have a different recommendation we'd love to know how you handle it. (flow-based is not an available option in MQC...do you just enable it under the interface?) You asked about TCP ACK packets...obviously we wouldn't want to drop any TCP syn/syn-ack/ack packets, but do you provision special queues just for them? We have a queue to protect the call-signals. No idea about RTT in buffer allowances - if you have a link to good info, please share. I've always wondered why we'd see drops when the interface utilization is low. We've just assumed there were micro-bursts that we couldn't catch in real time, or sampled NetFlow records. So, no I don't understand why WRED may drop packets when the queue is empty yet not drop packets when the queue is very full. Do you mind explaining it, or pointing me to a resource where I can study up on this particular behavior? TIA ... View more

Could Joseph or someone else please explain why it's not a good idea to use WRED? We use it as part of our standard CBWFQ policy-map on interfaces facing the carriers. ... View more