About Walker

Walker · 01-25-2023

I have a lab set up and I have been tinkering with pushing MACsec policies using EAP-TLS to workstations. When I have a workstation connected to an interface, everything works as intended. Link is secured using MACsec. When I plug in an IP phone to t...

Walker · 01-04-2023

I am in the process of migrating from v2.4 to v3.1 and during this process, a new device type was introduced to our network that only supports TLSv1.0. On the new v3.1 ISE server, I have disabled TLSv1.0 and TLSv1.1 in the security settings. The devi...

Walker · 11-18-2022

Good morning,I am attempting to troubleshoot an odd issue I am seeing with a Cat9300 v17.3.3 pointing to a v3.1 p4 ISE Server. When configuring interfaces with 802.1x/MAB, the devices will fail to Auth. The switch configuration matches a known good w...

Walker · 08-08-2022

The design of our new ISE cube has two SNS-3655 nodes that will act as the Admin/MnT/PSN on each. I am wondering if it is possible to run 3 dedicated connections to the appliance to separate the traffic based on the persona. When I look in the deploy...

Walker · 03-14-2022

We have some statically assigned endpoints in our environment that are currently only being profiled based off MAC OUI. I would like to scan for additional attributes via NMAP but it seems the common ports are not being detected. I've tested OS and S...

Walker · 01-10-2023

@Tim Glen Thank you for this guide!Quick question, would a configuration like this work if a macsec workstation hangs off of an IP Phone?

Walker · 01-05-2023

@Rodrigo Diaz Thanks for confirmation. We have already pressed the vendor to update to TLSv1.2 but I suspect that won't happen anytime soon.

Walker · 11-21-2022

Thank you all for the responses. On Friday I requested that the switch be reloaded to see if it would resolve the issue, but it was also upraded to a new code. Since then the issue seems to be resolved. Platform State from SMD is now showing as UP.I ...

Walker · 11-18-2022

We use the same interface template config for all devices, it would be strange that this particular NAD would have issues with it. I have scheduled to have this device rebooted tonight and hope to dive more into the config on Monday.

Walker · 11-18-2022

@thomas When I run the test aaa group radius new-code command, it shows up in the Live Logs. I would imagine if it was blocked somewhere, I would not be seeing them in the logs.

Member Since	‎04-03-2018 10:03 AM
Date Last Visited	‎01-25-2023 07:33 AM
Posts	34
Total Helpful Votes Received	60

User Statistics

User Activity

Enforcing MACsec on Computer connected behind IP Phone

Restrict TLS version in RADIUS Policy

AAA status - SMD Platform State: DEAD

Design that utilizes a dedicated interface per persona. Is it valid?

ISE 2.4 p13: Unable to detect any common ports via NMAP

Re: Configuring MACsec Switch to Host with Cat9k & ISE

Re: Restrict TLS version in RADIUS Policy

Re: AAA status - SMD Platform State: DEAD

Re: AAA status - SMD Platform State: DEAD

Re: AAA status - SMD Platform State: DEAD