I'm replacing an ACS 5.2 (among other patforms) with ISE 1.3. ACS has several internal users configured for device admin purposes and I need to migrate those users (whose password I don't know) to ISE. I first tried to manually create the users in ISE with a generic password and checked "Change password on next login" for each one of them, in order to allow them to change their passwords through terminal line. However, that didn't work out... I just see a message in ISE saying "24203 User need to change password" and get an "authentication failed" message in the terminal without the prompt for password change. Then I thought maybe I could export users from ACS and import them in ISE, but the export file from ACS does not contain users' passwords. So, 3 questions: - Does "change password on next login" work with RADIUS or just TACACS (I've seen it working with ACS before)? - Is there a way to include passwords in users export file in ACS in order to import it to ISE? - In case neither of the above options is valid, do you have any recommendation on how to manage this situation? Thanks in advance, Carlos Morais   ... View more

Hi, We are using our ASA as a Local CA Server to generate certificates for mobile device users and send them an email with an OTP to download and install the certificate. And we would like to know if there is a way to edit the email message body. Can you please help us? Thanks. Best regards, Carlos ... View more

Hi, We would like to do basic VLAN assignment in a Catalyst 3524-XL that doesn't support 802.1x. Can we somehow use ISE (iPEP maybe) or do we have to use NAC? Thanks, Carlos ... View more

Hi, I was wondering where IronPort keeps the data for reporting purposes, since we are sending all log files to a remote server and IronPort still shows information from several months before. Can someone answer this doubt? And how can I manage this data, if possible? Thanks in advance. Best regards, Carlos Morais ... View more

Hi, We've been deploying an ISE solution (1.1.0-665 version) in one customer and we have one doubt regarding Posture Assessment/Remediation. We're trying to check AV installation and definitions and this check is working fine but things get a little bit complicated when we try to remediate the machines. In our Posture redirect ACL we don't redirect DNS, DHCP and ICMP to some hosts/servers as well as the necessary "posture traffic" (TCP/UDP 8905, 8906 and 8443 to the ISE IP) and redirect all HTTP and HTTPS traffic to the ISE in order to force Posture for users who need the Web Agent. And this means that when Posture Assessment fails and we need to remediate client's machine we are going to have problems performing automatic remediation since our AV (McAfee), as well as many others, tries to access update servers using port 80 and that traffic will be redirected per Redirect ACL. Is there a way to overcome this problem? Including update servers in our Redirect ACL deny lines is not an option, since there are too many and they are dynamic. Can you help us with this issue? Thanks! Best regards, Carlos Morais ... View more