Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About vishrana
Stats
Member since
10-18-2017
12
Posts
2
Helpful
1
Solution
03-22-2019
09:04 AM
Hi all,
Need information on how to measure the radius authentication latency in ISE? What is the threshold value?
... View more
Labels:
Created by
vishrana
in Network Access Control
in Network Access Control
07-24-2018
01:22 PM
07-24-2018
01:22 PM
Hi Nitesh,
This is for initial auth of the endpoints (agentless devices) which are already connected to the switch.
We see successful auth sessions on some of the ports when we configure the switchport for dot1x/mab without doing the port bounce, however we do not see auth sessions for other ports. ISE wouldn't push any CoA if there is no auth session at first. All the devices connected have no supplicants. Ideally we bounce the ports when we fist configure the switch ports for dot1x/mab (verified with other AS engineers as well) but there is no reference material that recommends to bounce port.
I am just looking for some documentation to provide it to the customer for their reference.
... View more
Created by
vishrana
in Network Access Control
in Network Access Control
07-24-2018
10:52 AM
07-24-2018
10:52 AM
Hi All,
I have a customer who is looking for some documentation/reference which says port bounce is recommended after dot1x configuration on the switch port. We are able to see authentication sessions on most of the switch ports - mab auth, but not all of them (endpoints are connected) after we configured the switch for dot1x/mab authentication. The authentication works once we bounce the port (link state change).
Is there any document/reference that says port bounce is required/recommended after dot1x configuration on switch interfaces?
My customer is looking for a reasonable explanation on why port bounce is required when we can see some of the auth sessions doing the mab auth without port bounce but we can’t see the auth session for the other ports.
... View more
Labels:
Created by
vishrana
in Network Access Control
in Network Access Control
05-18-2018
01:12 PM
05-18-2018
01:12 PM
Haha.. I am Glad you asked that! Customer do not want to use one click approval, so instead of the approval link I added the sponsor portal URL link in the email sent to the sponsors. The customer wants the sponsors to login and go to pending accounts to see the request and than approve it, but they don't want the users to edit the sponsor's email address during approval. Just following orders!
... View more
Created by
vishrana
in Network Access Control
in Network Access Control
05-18-2018
12:28 PM
05-18-2018
12:28 PM
Jason, It seems like a bug to me as well, what if somebody mistakenly enters incorrect email? There is noway they will figure out why they don't see the pending accounts requests next time a guest account is requested to that sponsor for approval (Considering OWN_ACCOUNTS was set as a sponsor group). Surely we can make this thing better. My suggestion is we can have a settings gear for the sponsor portal where users can edit their profile only to some extent (for example- email address). Anyways, this is how the flow will be after adding the script: Sponsor will login to the sponsor portal > Click on the 'Pending Accounts' tab > selects the pending guest account from the list and click on Approve button> Approval confirmation pops-up > [Although 'Sponsor's Email address' input text field is disabled, Sponsor can see their email address that is in the database(AD/LDAP/LOCAL - based on the user)] Sponsor clicks on 'OK' to approve without modifying anything. (Please refer below image).
... View more
Created by
vishrana
in Network Access Control
in Network Access Control
05-18-2018
08:32 AM
05-18-2018
08:32 AM
Hi Serhii, This is Great! I test the script, it disables the sponsor's email address input field. However if I include the line "$('#approveForm input').val('aaaaa@aa.aa');" it changes the current sponsor's email id. I cannot give a specific email-id in the script. So instead I removed that line, which gives me the default value of the sponsor's email id (Extracted from the AD/LDAP) when the Approve message pops-up - Not allowing the sponsor to edit the field. I am going to use this script for now. Thanks a ton! <script> setTimeout(function() { $('[href="#approve"]').on('click', function() { $('#approveForm input').prop('disabled', 'true'); }); }, 4000); </script>
... View more
Created by
vishrana
in Network Access Control
in Network Access Control
05-17-2018
11:22 AM
05-17-2018
11:22 AM
That would be great! I really appreciate your help. Thanks & Regards Vishal Rana
... View more
Created by
vishrana
in Network Access Control
in Network Access Control
05-17-2018
09:31 AM
05-17-2018
09:31 AM
Hi Jason, It asks for the sponsor's email address each time sponsor clicks on approve button. Also, Is it really necessary for the sponsor to validate his/her email address?? The email id of the sponsor is attached to the username based on AD/LDAP and that is the reason the input field is populated with the sponsor's email address (user currently login to the sponsor portal) when the Approval confirmation pop's up. The issue is the sponsor can edit the email! Considering the Sponsor-Group configured is "OWN_ACCOUNTS" So what I noticed is - if the sponsor changes the email address in the approval confirmation field, the username is tied to the updated email address. Which is a problem because the next time the user will login to the sponsor portal he/she will see the pending request which is for the updated sponsor email-id. ISE keeps record of username with updated email id (Verified in the sponsor audit log and also tested out the same). So that is the reason it would be better if sponsor's are restricted to edit their email address field during Approval. Thanks & Regards Vishal Rana
... View more
Created by
vishrana
in Network Access Control
in Network Access Control
05-17-2018
08:15 AM
05-17-2018
08:15 AM
Hi all, I am trying to create a customized Sponsor Portal based on the customer's requirement. One of the requirement is to not allow the sponsor to put in their email address when they click on the Approve button in Pending Accounts tab (Please see the Screenshot for reference). Is there a way to just approve the account once the sponsor clicks on the Approve button - without asking for confirmation? If not than hiding the Sponsor's Email address input field in the Approval Pop up will also work. Thanks, Vishal Rana
... View more
Labels:
04-25-2018
05:52 PM
Thanks chyps that is exactly what I wanted to confirm. "ISE admin portal supports TLS 1.1 and 1.2 since ISE 2.0" I am not making ERS API calls. I am making REST Monitoring calls to Mnt service (Standalone ISE node) on 443 to quarantine the endpoints by IP-address using the following API calls: https://<primary_ise_node>/ise/eps/QuarantineByIP/{IP_Address}
... View more
04-25-2018
03:16 PM
Hi all, I am trying to make an API call to ISE 2.2 on port 443. The server from where I am making the call uses TLS1.0 for sending the Hello during the TLS handshake. ISE rejects the request and does not responds back.with server Hello. I am able to make the same request to ISE from a different server using TLSv1.2 and it works as intended. Can anybody confirm if ISE does not supports TLSv1.0 for SSL communication?
... View more
Labels:
03-22-2019
Hi all, Need information on how to measure the radius authentication
latency in ISE? What is the thr...
07-24-2018
Hi Nitesh, This is for initial auth of the endpoints (agentless devices)
which are already connected...
07-24-2018
Hi All, I have a customer who is looking for some
documentation/reference which says port bounce is ...
Created by
vishrana
in Network Access Control
05-18-2018
05-18-2018
Haha.. I am Glad you asked that!Customer do not want to use one click
approval, so instead of the ap...
Created by
vishrana
in Network Access Control
05-18-2018
05-18-2018
Jason,It seems like a bug to me as well, what if somebody mistakenly
enters incorrect email? There i...
Created by
vishrana
in Network Access Control
05-18-2018
05-18-2018
Hi Serhii, This is Great!I test the script, it disables the sponsor's
email address input field. How...
Created by
vishrana
in Network Access Control
05-17-2018
05-17-2018
That would be great! I really appreciate your help. Thanks &
RegardsVishal Rana
Created by
vishrana
in Network Access Control
05-17-2018
05-17-2018
Hi Jason,It asks for the sponsor's email address each time sponsor
clicks on approve button. Also, I...
05-17-2018
Hi all,I am trying to create a customized Sponsor Portal based on the
customer's requirement. One of...
04-25-2018
Thanks chyps that is exactly what I wanted to confirm. "ISE admin portal
supports TLS 1.1 and 1.2 si...
Public Statistics
| Date Registered | 10-18-2017 07:11 AM |
| Date Last Visited | 04-02-2020 02:40 PM |
| Total Messages Posted | 12 |
| Total Helpful Votes Received | 2 |
.jpg "VIP Advocate"){kind=icon}
