Hello, I am running ISE 2.4 and ASA v9.9 in my lab setup. I have two user on ISE and assign different priv-level to these users: on-admin: PRIV15 on-read: PRIV3 Both user accounts on ISE has username/password as well enable password.   My ASA config:    on-asa5506# sh run aaa aaa authentication http console LOCAL aaa authentication serial console ON-TACACS LOCAL aaa authentication enable console ON-TACACS LOCAL aaa authentication ssh console ON-TACACS LOCAL aaa authorization command ON-TACACS LOCAL aaa authorization exec authentication-server auto-enable aaa authentication login-history on-asa5506#   When I authn on console with on-read (PRIV3), I can login successfully but cannot get not enable mode with my saved password in ISE. Username: on-read Password: ********** User on-read logged in to on-asa5506 Logins over the last 1 days: 1. Failed logins since the last login: 0. Type help or '?' for a list of available commands. on-asa5506> en Password: ************** Password: ************** Password:   ISE Logs shows following error message:   When I SSH with same user, I am directly in enable mode but with priv=3 login as: on-read on-read@192.168.2.1's password: User on-read logged in to on-asa5506 Logins over the last 1 days: 3. Last login: 11:07:37 CEDT Aug 16 2019 from 192.168.2.60 Failed logins since the last login: 0. Type help or '?' for a list of available commands. on-asa5506# sh cur Username : on-read Current privilege level : 3 Current Mode/s : P_PRIV on-asa5506#   Can someone help to understand this behaviour?   Thanks in advance.   Cengiz ... View more

Hello everyone,   we are planing to use ISE for device administration for a large scale sp-like customer. We are using free-radius and want to replace it with ISE.    We have a complex environment, therefore our goal is to keep policies as simple as possible.   There are about 10 different departments each with its own network admin team, which is divided in 5 different teams like security, switching, routing etc. Within these teams we will have privileges WRITE, READ and LIMITED. Additionally we have to differentiate in the authorisation profiles between several vendors.     I have to assign more then one authz result to a authz policy.  So the authz policy would be something like the attached screenshot.   So my question/concern is about authz profile: Afaik when I have more then one authz profile assigned to a policy all attributes will be send to NAD. Would that have any impact on the NAD, when e.g. Cisco device receives radius attributes from other vendors. Is there maybe a better approach to design policies? I want to avoid to multiply the set of authz policies (see screenshot) by the number of vendors? Is there maybe a more intelligent approach where ISE chooses the authz profile which fits to the NAD? Maybe roadmap? Thanks in advance for your input. Cengiz ... View more

Hello everyone, I want to assign a predefined dashboards to user or even user roles as under my dashboard? On the gui I was not able to find a option. Maybe I missed it : (   Waiting for you feedback. Thanks in advance. Cengiz ... View more

Hello everyone, I am having an strange install issue with my LMS 4.2 on vmware. The installation is running fine. There is no major error messages during the install. After the installation i am getting a "localhost username:" instead of a "setup" prompt. When I write setup for username the system is prompting me for password. Password recovery is also not working. When I am running password recovery from the ISO image i am getting an error message (see attached file). Has anyone run into the same issue before? Thanks in advance, Cengiz     ... View more

Hello, my setup is straigthforward nothing special ... l2l vpn tunnel between ASA5520 (static ip)  as hub and Cisco RV215w (dynamic ip) as spoke. The setup is working fine ... asa terminates l2l ipsec vpn coming from rv215w. The tunnels are stable. As attachment you can find my config. We are planing about 300 locations terminating on ASA which should be fine for a ASA5520 as long as you terminate all sessions on defaultl2lgroup. But we would like to terminate each session on a different tunnel group in order to block each location/rv215w in case of theft. The problem is; as soon as i am configuring a tunnelgroup for each spoke ASA is not able to assign vpn session to spoke. Here is the error message: 4|Feb 20 2014|16:13:11|713903|||||Group = DefaultRAGroup, IP = 192.168.2.251, Error, peer has indicated that something is wrong with our message.  This could indicate a pre-shared key mismatch. 4|Feb 20 2014|16:13:11|713255|||||IP = 192.168.2.251, Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name '192.168.2.251'. When I create the tunnelgroup with ip address there is no problem. ASA is able to assign the ip to tunnelgroup and everything is fine. As the rv215w has dynamic ip on outside interface this is not an option. The problem is that RV215w is sending its outside ip as ike key. I was not able to change the ike key from ip to something else ... e.g. hostname I  found a good solution for ASA and IOS as spoke but no way for rv215w. ASA and IOS you can configure the ike key: crypto isakmp identity key-id SPOKE1 http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113573-sol-tunnels-groups.html?referring_site=smartnavRD Would be glad to here if there is another solution how we can solve the problem to block each rv215w in case of theft. Hope i was clear in my problem description. Looking forward to here from you. Cengiz ... View more