Hello, We run ISE 1.4.0.253 Our "License Usage" panel indicates that we've 320 "Plus" licenses consumed. How can we identify all endpoints which use these "Plus" licenses? Could we generate a list of theses endpoints? Do they have a specific field/value inside logs? "License Usage" panel speaks about "current usage". Does this license usage amount is all endpoints currently connected? Or is it the cumulative of all endpoints on which a Plus license was applied? Does "Plus" licenses have expiration or cleanup delay? Regards, Chris ... View more

Hello, We run ISE 1.4.0.253 Our ISE is set as Certificate Authority (Administration > System > Certificates ). Usually Endpoints obtain certificates automatically from Certificate Templates . I would like to generate manually a Certificate from ISE Certificate Authority, to insert it manually into a special support/OS (as WinPE). Do you know how can I generate this Certificate from ISE Certificate Authority? Do there have a direct/simple way?... or do I have to create a dedicated Certificate Templates, and use an endpoint (as Windows PC) to generate automatically a Certificate , them export this Certificate from this endpoint and insert it manually into a special support/OS (as WinPE)? Regards, Chris ... View more

Hello, I know that Windows XP is not more supported, but we still have some workstations running Windows XP, and some can not be upgraded to Win7 (or later) because they run special installed software or have special plugged devices. We try to run the lastest version of AnyConnect 3.1 (3.1.10010) under Windows XP but we get the error "service unavailable" about NAM. Inside Windows Services, we can see that "Cisco AnyConnect Secure Mobility Agent" service runs correctly, but "Cisco AnyConnect Network Access Manager" service has not started and can not be started! It's the same problem if I install all AnyConnect modules, or NAM only. I was able to install an old AnyConnect version, 3.1.05160, and it runs correctly, none "service unavailable" error. But we'd prefer to use the last version which includes all last patchs. Did you meet this problem? Do you know how to resolve it? Regards, Chris   ... View more

Hello,   We would like to set our ISE as CA (ISE 1.4.0.253 ADE-OS 2.2.0.421), but we don't have the "Certificate Authority" tab inside our panel, please see the printscreen "our panel.jpg" in attachment.   Usually we should have this tab at: Administration > System > Certificates > Certificate Authority as on the printscreen "certificate authority.jpg" in attachment.   Could you tell us if this problem comes from: - license limitation, - service disabled problem, - upgrade problem (we've just migrated from 1.2 to 1.4) or another reason?   For your information, when we log into the PAN server and do a "sh ap stat ise", we get : ISE PROCESS NAME STATE PROCESS ID -------------------------------------------------------------------- Database Listener running 2976 Database Server running 31 PROCESSES Application Server running 24634 Profiler Database running 4989 AD Connector running 6801 M&T Session Database disabled M&T Log Collector disabled M&T Log Processor disabled Certificate Authority Service disabled pxGrid Infrastructure Service disabled pxGrid Publisher Subscriber Service disabled pxGrid Connection Manager disabled pxGrid Controller disabled Identity Mapping Service disabled   Regards, Chris   ... View more

Hello, We use Cisco ISE 1.2.0.899 on our network (we plan to upgrade to 1.3 in some months). Our network includes Cisco models 2960S (and some 2960T) about wired and 2602I (with WISM2) about wireless. We have to allow PXE boot on one (or many) VLAN. Do you know what's the best practice to use PXE on a 802.1X network ? Does ISE and/or Switch can recognize PXE request? Do we have to use settings/rules into ISE or on Switch? Does the easy way is to allow PXE on WebAuth VLAN? Regards, Chris ... View more

Hello, We use Cisco ISE 1.2.0.899 on our network. We would like to add a Web based documentation about Guest Portal ("how to find MAC Address", "how to release/renew IP Address"...) on our network to help users. Idealy we would like to host these data on the Web server integrated to ISE (which already hosts Guest/Sponsor Portals). Does ISE allow that? Unregistered users (or not already profiled devices) are automatically redirected to the Guest Portal, but we would like they're able to access to this documentation (hosted on ISE Web Server or another Web Server). How can we set that? By not using port 80 to access to this documentation? Which elements does ISE identify to redirect browsers to the Guest Portal? Is it port 80, http protocol or other? Regards, Chris   ... View more

Hello, We use Cisco ISE 1.2.0.899 on our network. We've already set the Domain devices rules (AD), and it works correctly. Now we work on the BYOD rules, and I've a question about the "Device Registration Portal" processes. Can I create a group (Endpoint Identity Groups or others) or a condition (Simple/Compound Conditions or others), which will be automatically attribuated to all registred devices from "Device Registration Portal" (Guest Portal)? Our objective is to created a basic rules inside Authorization Policy for all BYOD without OS distinction. Currently, we've created a rule with the (built-in) Workstation group: Identity Management > Groups > Endpoint Identity Groups > Profiled > Workstation But I'm not sure that all registred devices are going to obtain the "Profiled" group or one of these sub-groups (Cisco-IP-Phone or Workstation)? Can I choose and set the group or the condition that will be automatically attribuated to registred devices, or I have to use built-in groups inside "Endpoint Identity Groups"? For information, currently when I registe a new device from "Device Registration Portal" (Guest Portal), by adding its MAC Address, this device is registred with the attributes: BYODRegistration Unknown DeviceRegistrationStatus NotRegistered EndPointPolicy Nortel-Device EndPointProfilerServer ... EndPointSource GUEST Portal IdentityGroup Profiled MACAddress ... MatchedPolicy Nortel-Device OUI Wistron InfoComm (Kunshan)Co PolicyVersion 0 PortalUser ... StaticAssignment false StaticGroupAssignment false Total Certainty Factor 10 UpdateTime 1400874683250 after a new authentication the attributes change to: BYODRegistration Unknown DeviceRegistrationStatus NotRegistered EndPointPolicy Windows7-Workstation EndPointProfilerServer ... EndPointSource GUEST Portal IdentityGroup Workstation MACAddress ... MatchedPolicy Windows7-Workstation OUI Wistron InfoComm (Kunshan)Co PolicyVersion 0 PortalUser ... StaticAssignment false StaticGroupAssignment false Total Certainty Factor 60 UpdateTime 1400875968919 User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Regards, Chris ... View more

Hello, We've just begun to work with ISE. Is it the good place to post on ISE, or there is a dedicated forum in another place? We'd like to create some rule depending of Computer member groups AND Users member groups from AD, but we meet some difficulties. We've created AD groups for Computers and Users depending of their Department: Users_1 Users_2 Computers_1 Computers_2 When we create some basics rules regarding one group only: - with a group Computers_x to attribute a specific VLAN to a computer (when no Windows session is opened), it runs correctly. - with a group Users_x to attribute a specific VLAN to an user (when Windows session is opened), it runs correctly. But when we create a rule regarding a group from Computers and one from Users, to attribute a specific VLAN to an user on a specific computer, this rule is not applied. Is it possible to use ISE on this way? Thanks for help. Regards, Chris ... View more