Howdy all.   I'm hoping someone can help answer whether EEM is supported on a 2960S switch with LANBASE (not LAN Lite). I'm running 12.2(55)SE9 UNIVERSAL, which, according to Feature Navigator, supports EEM 3.2. When I try to configure event manager on the CLI, the command is unrecognized. I have tried this under both the default and lanbase-routing SDMs.   Thanks, Justin ... View more

Hi all. I'm using EEM running on a 3750 running 12.2(55)SEE9 to monitor up/down status of a server. If the server goes down (icmp-echo ipsla fails), I'd like to SSH into an ASA running 9.1(5) and issue a change to the NAT configuration so that the outside global NAT points to a different (still up) server. The issue is that when the EEM applet executes, it hangs after logging in. If this post provides any clues, it seems to have something to do with the ASA handles non-interactive SSH input: http://blog.ipspace.net/2008/01/telnetssh-session-cannot-be-started.html Specifically, it seems that EEM isn't able to successfully pass a newline/carriage return with the action cli command, e.g.: action 1.0 cli command "enable" pattern "#" action 2.0 cli command "ssh -l admin <ASA-IP>" pattern "word:" action 3.0 cli command "Cisco123" pattern "#" action 4.0 cli command "enable" pattern "#" action 5.0 cli command "no nat ... " etc.   In this example, I get through the password and then EEM hangs on "enable" I've tried passing the newline character along with the command (I've tried both \012 and \x0a) and in neither case does the ASA seem to take it. Running an EEM applet to SSH into any other IOS switch or router doesn't give me issues. It's only when I try to log into the ASA.   Does anyone know of a way to get SSH to work with an ASA through EEM?   Thanks! Justin ... View more

Hi all. I have a (2) Policy Services Nodes (PSNs) in an ISE 1.2 deployment running patch 1. We are using Wireless MAB and CWA on 5760 Wireless LAN Controllers running v3.3.3. We are hitting an issue wherein a client first passes MAB and then gets redirected to a CWA custom portal. The client then receives a Session Expired message. This seems to be related to the fact that CWA is technically a 2-stage authentication (MAB by the WLC and then CWA by the client). Specifically, it seems to happen when the WLC makes its MAB RADIUS access-request to PSN-1 and then the client comes in to PSN-2 to complete the CWA. This issue does not happen when only one PSN is in use and all authentication traffic (both MAB RADIUS and CWA) is directed at a single PSN. Clients resolve the FQDN in the redirect URL using public DNS and a public DNS zone file (call it cwa-portal.example.com). cwa-portal.example.com has two A records for the two PSN nodes. DNS is responding to queries using DNS round-robin. I have the PSNs configured in a Node Group for session information replication between PSNs, but this doesn't seem to make a difference in behavior.   So I ask: What is the recommended architecture for CWA when using more than one PSN? It seems that you would need to keep the two authentication flows pinned together so that they both hit the same PSN when using more than one PSN in a deployment. A load balancer balancing on the SessionID string comes to mind (both the RADIUS MAB request and the CWA URL contain this unique per-client SessionID), but that seems terribly overbuilt for a seemingly simple problem. On the other hand, it also seems like using a Node Group setup should easily be able to replicate client SessionIDs to all nodes in the deployment so that this isn't an issue. I.e., if the WLC authenticates MAB on PSN-1, then PSN-1 should tell the Node Group about it such that when the client CWA's on PSN-2, PSN-2 doesn't respond with a Session Expired message. Is there any Cisco documentation that talks about this?   Possibly related: https://supportforums.cisco.com/discussion/12131531/ise-12-guest-access-session-expired   Justin ... View more