About Nicholas DiNofrio

Nicholas DiNofrio · 01-14-2019

On a Meraki AP (MR42) running MR.25.11 firmware that has been configured in VPN: Tunnel Mode to send all traffic to an Meraki MX appliance/concentrator which authenticates to ISE 2.3 patch 5. We are seeing after ISE receives an Accounting-Stop (Termi...

Nicholas DiNofrio · 08-22-2018

I've been able to successfully configure and test CWA Chaining after authenticating to ISE via Dot1x (User Auth) then logging into a ISE Guest Portal through CWA flow to enforce the Active Directory group membership for the same or different user acc...

Nicholas DiNofrio · 05-02-2018

Wanted to get more information regarding the use of PassiveID and when it should not be used.For example, if endpoint supplicant is configured for (Radius) Machine Authentication via EAP-TLS and User-to-IP mapping via PassiveID is desired, is this ty...

Nicholas DiNofrio · 01-30-2018

I have a customer whom have recently performed a reimage (reinstall ISE 2.2 software) on a SNS-3495 appliance. They connected the local PC to the appliance to the Ethernet 1 interface, and during the installation to format whole hard drive disk and...

Nicholas DiNofrio · 01-15-2019

Thank you Timothy for your feedback and guidance. Always appreciate times to ensure I have the correct understanding. I went back and looked at the prrt logs from the ISE Support Bundle and sure enough found the "cisco-av-pair=SkipSessionRemoval=t...

Nicholas DiNofrio · 01-14-2019

I found where the PortalUser attribute does not appear in the endpoint cache on ISE GUI: Work Centers > Network Access: Identities > Endpoints > {select endpoint} > tab: Attributes ; appears to be due when a HotSpot Portal updates the endpoint (i.e. ...

Nicholas DiNofrio · 01-14-2019

I found where the PortalUser attribute does not appear in the endpoint cache on ISE GUI: Work Centers > Network Access: Identities > Endpoints > {select endpoint} > tab: Attributes ; appears to be due when a HotSpot Portal updates the endpoint (i.e. ...

Nicholas DiNofrio · 01-14-2019

During a MAB authentication is definitely more limted then compared with a 802.1x authentication in respect with matching an identity with a username or other contextual information. In my opinion, this is mainly due to where the identity resides -...

Nicholas DiNofrio · 08-23-2018

I ended up finding a solution that so far has worked very well to accomplish the requirements while authenticating only with MAB, no Dot1x. Also, technically not CWA Chaining either, however, still enforcing AD group membership. Here's the flow I ...

Member Since	‎03-09-2015 05:49 AM
Date Last Visited	‎05-24-2023 12:37 PM
Posts	16
Total Helpful Votes Received	11

User Statistics

User Activity

Accounting Stop not Terminate Session on ISE

Is possible to use CWA Chaining with MAB authentication?

Questions regarding Radius + PassiveID

Expected time to install ISE 2.2 on SNS-3495

Re: Accounting Stop not Terminate Session on ISE

Re: Is possible to use CWA Chaining with MAB authentication?

Re: Is possible to use CWA Chaining with MAB authentication?

Re: Is possible to use CWA Chaining with MAB authentication?

Re: Is possible to use CWA Chaining with MAB authentication?