I have LDAP configured with LDAPS over 636 and that works fine, and can communicate securely.   However, using the AD Connector there are no option for SSL, and I can see it is using LDAP over port 389 through our firewalls.   As mentioned, LDAP and AD Connector are two different types of External Identity Sources. ... View more

I am also seeing this behavior in 2.4 as well as 2.6 patch 3 My firewall logs are showing the connections to the Active Directory join point using 389 and there are no settings anywhere for changing to 636 and therefore SSL.   Could do with some advice on the issue here, as when AD admins start forcing SSL for security reasons, this could potentially break the connection from ISE and therefore client network authentications throughout an enterprise network.  ... View more

Hi, This looks similar to what I also want to achieve. We could then authenticate both computer and user with less interaction by the user. Two features which seem almost ideal, and nearly match the MS equivalent Always On seem to be: Management VPN Tunnel Connects before the user, and uses the Computer certificate for limited access. Always-On VPN Can be set to connect at login, and can use the User certificate for full access. Unfortunately, these both use Trusted Network Detection, which conflicts. Management VPN Tunnel connects fine, but then Always-On VPN doesn't because it is then on the (limited) network.   I wonder if anyone else has tried this and found any workarounds? Or if there is anything in the pipeline form Cisco to get this working which will greatly improve user experience?   ... View more

I am also getting the error message: You are attempting to generate a CSR whose subject matches the subject of an existing certificate on the same node. This is only permitted when you are replacing a certificate of the same role. Note that the subject is the concatenation of several fields (for example, CN, O, OU, etc.) You can create a unique subject by varying the values in these fields.   But I am trying to renew/replace an existing certificate which is due to expire. ... View more

Hi and thanks for taking the time to look at this and respond.   Unfortunately, that reference is for ios 15, and those commands are not available in ios 12.1(22)EA13 The catalyst 2950 is not supported above 12.1   I don't know if there is anything helpful in 12.1(22)EA14, but as it's an EOL switch I sadly can't find a download. ... View more