Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mgr
Stats
Member since
02-04-2016
15
Posts
5
Helpful
1
Solution
01-23-2019
02:20 AM
Hi,
I am trying to configure profiling using Cisco ISE 2.4 to find out the devices connected to my switch interfaces before configuring them for 802.1x authentication.
Cisco ISE profiling has lots of probes listed, but my query is :
1. Is it possible to enable only profiling first without configuring the switch ports for 802.1x authentication? Can i enable all global configuration related to RADIUS & probes and gather information?
2. If yes, which probes would help me gather the connect device's hardware information?
... View more
Labels:
01-22-2019
12:17 AM
Hi,
Thanks for your response. I would like to try the windows native supplicant and i am fine with the authentication in succession - machine authentication during bootup & user authentication later. Could you please let me know if there are any guides to configure my windows machine for this?
... View more
01-21-2019
08:33 AM
Another question - I am trying to authenticate a corporate user with a corporate device to gain access to the network. The corporate device has two certificates – one for the machine, another for the user. I want to match the hostname of the computer against my AD’s “domain computers” group & domain user name of the user against my AD’s “domain users” group. I only have base license of ISE and not any other additional licenses. I am using windows native supplicant and not any other additional supplicants. Is it possible to achieve this? If yes, how to configure my windows machine to send both machine and user credentials to ISE?
... View more
01-09-2019
11:17 PM
Hi Jason,
Thanks a lot for responding. This answers my query. The link is very useful as well.
... View more
01-09-2019
10:29 AM
Hi,
We are planning to deploy ISE for 802.1x authentication for wired LAN. We want to authenticate the AD users who are logging in through domain PCs to gain access to network based on 802.1x.
Please help me with the following scenario.
1. User logs into his/her laptop using domain credentials (from cache without connecting to network)
2. Log in is successful.
3. After logging in, connects the laptop to the network port that is configured for 802.1x authentication.
In this case, if we configure policy to allow users based on AD username & password, will ISE prompt the user to provide username & password once again when he/she connects to the network or will the authentication happen in the background without any user intervention.
... View more
Labels:
Created by
mgr
in Other Data Center Subjects
in Other Data Center Subjects
07-24-2018
09:35 PM
07-24-2018
09:35 PM
Hi,
Thanks a lot for your response. I have responded to your queries. The NSX in my environment is getting restricted to Leaf1 & Leaf2 which i had shown in my diagram. My physical server is not connected to leaf2 and so it does not have layer2 adjacency. This means that i cannot use NSX native L2 adjacency -software Layer2 bridging. Please correct me if i'm wrong.
In order to overcome this restriction, i planned to use MP-BGP - another overlay in the switches. Let's say i put my virtual server 10.10.10.5 in vxlan 5000 and software L2 bridging of this vxlan to vlan500. I can locally create VLAN500 if leaf1 & leaf2. My physical server connected to leaf3 would also be put in vlan 500. I would use the MP-BGP to create a VTEP and map it to another VXLAN for bridging. Will this scenario work and allow me to have the gateway of the servers in the DLR?
I have answered your queries.
I assume 10.10.10.x is your overlay network. -> This is the subnet for servers.
Do you use NSX logical switch? -> Yes, we are planning to use NSX logical switch.
Is the gateway of the virtual environment on NSX DLR? -> Yes
Is your requirement to have physical server 10.10.10.6 on the same subnet as the network on the virtual environment? -> Yes.
I am attaching a rough diagram to explain the scenario.
... View more
07-24-2018
01:33 AM
Hi,
In our data center network, there is a requirement for having hybrid overlays as there is a mix of vmware NSX-v and physical work loads. There is a scenario in which hosts in the same subnet are spread across the physical and virtual environments.
We are planning to implement leaf-spine architecture with Nexus 9Ks and have MP BGP - EVPN.
1. Is it possible for the physical server to reach its gateway which is residing inside the virtual environment over VXLAN ?
2. How to make my physical and virtual VTEPs communicate? Is there any configuration example for having hybrid overlays?
3. How to make the servers inside virtual environment communicate with L4 & L7 devices?
I am attaching a sample diagram for my requirement.
... View more
Labels:
07-17-2018
02:48 AM
Hi, We are planning to deploy Cisco ISE in our environment for both 802.1X authentication and Tacacs+ for Network device administration. Is there an option to configure Tacacs+ logs being sent from PSN to external log servers other than MnT node?
... View more
Labels:
Created by
mgr
in Network Access Control
in Network Access Control
07-16-2018
03:07 AM
07-16-2018
03:07 AM
Hi, To make myself very sure, Is the below mentioned diagram a valid design for positioning the ISE components? I am planning to position two PSNs one in each data cener. In case, the local PSN fails, the endpoints need to authenticate with the other DC's PSN.
... View more
Created by
mgr
in Network Access Control
in Network Access Control
07-12-2018
11:09 PM
07-12-2018
11:09 PM
Hi Chyps, Thanks a ton for your clear explanation. This answers my query completely.
... View more
Created by
mgr
in Network Access Control
in Network Access Control
07-12-2018
09:21 AM
07-12-2018
09:21 AM
Hi Chyps, Thanks for your response. If i require posture assessment and remediation for Corporate LAN users in addition to VPN users, should i go with Anyconnect agent? Is there any other agent available for this purpose?
... View more
07-12-2018
07:45 AM
Hi, We are looking for ISE deployment across two data centers for wired & wireless 802.1x authentication and posture assessment for corporate and VPN users. Option 1 : Data center 1: 1. PAN - Primary 2. MnT - Primary 3. PSN - Primary for DC1 Data center 2: 1. PAN - Secondary 2. MnT - Secondary 3. PSN - Primary for DC2 Option 2: Data center 1: 1. PAN/MnT - Primary 2. PSN - Primary for DC1 Data center 2: 1. PAN/MnT - Secondary 2. PSN - Primary for DC2 Could you help clarify the below queries? 1. Can we put two PSNs in a device group(or we need more than two)? 2. Do we need to have dedicated "in-line posture" node for VPN users? Or can we use the PSN nodes itself? 3. In Option2, can we keep the PAN/MnT nodes across data centers or they have to be in the data centers?
... View more
Labels:
04-05-2018
08:12 PM
Hi Vinny,
You have mentioned "All leafs will become default gateways for VTEP networks". Could you please explain the following items as i have a similar requirement for one of my projects.
1. How many uplink did you configure from one leaf to one spine?
2. What is the IP addressing which you used for VTEP? Which pair of leaf did you configure the SVI for the VTEPs?
3. If SVIs are configured in a leaf pair and Vmware hosts are connected to another leaf which does not have SVI, how would the full feature of the ECMP be utilized?
Thanks in advance.
... View more
01-23-2019
Hi, I am trying to configure profiling using Cisco ISE 2.4 to find out
the devices connected to my s...
01-22-2019
Hi, Thanks for your response. I would like to try the windows native
supplicant and i am fine with t...
01-21-2019
Another question - I am trying to authenticate a corporate user with a
corporate device to gain acce...
01-09-2019
Hi Jason, Thanks a lot for responding. This answers my query. The link
is very useful as well.
01-09-2019
Hi, We are planning to deploy ISE for 802.1x authentication for wired
LAN. We want to authenticate t...
07-27-2018
Hi, In our customer data center, there is a requirement for configuring
NSX using Nexus 9K switches ...
07-24-2018
Hi, Thanks a lot for your response. I have responded to your queries.
The NSX in my environment is g...
07-24-2018
Hi, In our data center network, there is a requirement for having hybrid
overlays as there is a mix ...
07-17-2018
Hi, We are planning to deploy Cisco ISE in our environment for both
802.1X authentication and Tacacs...
07-16-2018
Hi, To make myself very sure, Is the below mentioned diagram a valid
design for positioning the ISE ...
07-12-2018
Hi Chyps,Thanks for your response. If i require posture assessment and
remediation for Corporate LAN...
07-12-2018
Hi, We are looking for ISE deployment across two data centers for wired
& wireless 802.1x authentica...
Public Statistics
| Date Registered | 02-04-2016 03:42 AM |
| Date Last Visited | 04-04-2019 01:19 PM |
| Total Messages Posted | 15 |
| Total Helpful Votes Received | 5 |
