Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About hnohre
Stats
Member since
09-10-2009
16
Posts
3
Helpful
0
Solutions
Created by
hnohre
in Network Access Control
in Network Access Control
05-15-2019
08:39 AM
05-15-2019
08:39 AM
I have a python app using ISE pxGrid interface. It used to work fine a while ago, but something changed.
Now I cannot do the Service Lookup, after sending the following:
url=https://10.1.41.70:8910/pxgrid/control/ServiceLookup request={"name": "com.cisco.ise.session"}
I get
401 Unauthorized back from ISE.
I am using client cert to auth the session. Cert looks OK.
What could cause this request to fail? Which log files could give me further indications of what is wrong?
... View more
Labels:
Created by
hnohre
in Network Access Control
in Network Access Control
10-22-2018
02:34 PM
10-22-2018
02:34 PM
Thanks. I am sure I can remove the stale sessions as per your suggestion.
But is there meaning of the state anywhere documented?
My guess is that the session gets AUTHENTICATED, then to STARTED after accounting start, then back to AUTHENTICATED after accounting stop, or after a timeout??
But I prefer not to guess.
Also what is the expected behaviour wrt ISE purging these sessions? Should they be purged after accounting stop, or after a timeout, or never?
... View more
Created by
hnohre
in Network Access Control
in Network Access Control
10-21-2018
10:44 AM
10-21-2018
10:44 AM
When scripting to ISE pxGrid interface I find that
- if I use the /getSessions API point I retrieve all the sessions
- if I use the a loop, trying to get sessions for specific mac addresses using the /getSessionsByMacAddress, somethimes I get a status 204 back, with no content (no info on the endpoint).
Is this some sort of rate limiting behaviour of ISE pxGrid interface, and is it in that case documented?
... View more
- Tags:
- pxGrid
Labels:
Created by
hnohre
in Network Access Control
in Network Access Control
10-21-2018
10:39 AM
10-21-2018
10:39 AM
When querying the pxGrid sessions interface I get quite a few more entries than I do from the ISE GUI interface (Live sessions).
Upon investigation, it shows that the sessions which also appear in ISE GUI interface are in state STARTED or POSTURE, whereas the sessions retrieved through pxGrid interface also includes sessions in state AUTHENTICATED.'
Many of these sessions from pxGrid that are in state AUTHENTICATED are also very old, some from 6 months back.
I believe I can (in my script) easily filter on this, but it would still be nice to have a pointer to the difference between
sessions that are kept in pxGrid, but now shown in ISE GUI (live sessions).
... View more
Labels:
12-18-2017
09:06 AM
Hi ISE posture module fails to install on one Windows 7 because of "File Integrity Check Error". Installation is from ISE headend. I have verified the SHA512 with that on CCO, and they are the same. The other modules (AnyConnect VPN and NVM) install ok. 6 Installation works on another machine (Win10). Any known issues here? One thing that springs to mind is that I had previously installed Amp for Endpoints, and in order to do that I had to install a hotfix for SHA256 on the machine where it fails.
... View more
- Tags:
- ise-posture
Labels:
Created by
hnohre
in Network Access Control
in Network Access Control
12-17-2017
11:15 AM
12-17-2017
11:15 AM
Thanks Craig, I have read those documents, but I find them still out of date with the latest post-Denali releases of IOS. Just some examples - ip device tracking has disappeared completely from switch CLI, …. some release docs say it is turned on automatically if you enable a feature requiring it, but I had to turn it on explicitly with device-tracking on the the interfaces debug radius does not work at all, I also think other debug commands have changed After having done I am sure 100+ switch configs with older versions of switch software, I am really suffering here. I thin these docs need to be updated. Regards Hakan
... View more
Created by
hnohre
in Network Access Control
in Network Access Control
12-15-2017
10:51 AM
12-15-2017
10:51 AM
Can I have a pointer to IOS XE (Denali and later) configuration examples/guides for ISE integration? Quite a few things has changed like IP device tracking config, debug RADIUS not working etc. I found the ISE GOLD training example conf in the Bootstrap LAB very useful for legacy IOS switch configs . Has that been updated?
... View more
- Tags:
- ise-ios-xe
Labels:
Created by
hnohre
in Network Access Control
in Network Access Control
10-13-2017
12:07 PM
10-13-2017
12:07 PM
Hi Hsing This is the same thing - but only almost. For the customer it works for the first authz - putting it into “Not-Compliant Posture” state. It is the with the CoA (after posture compliance) where the internal dACL does not work! Would you say it is a bug if the dACL can be applied during first auth, but not after CoA? Regards Hakan
... View more
Created by
hnohre
in Network Access Control
in Network Access Control
10-13-2017
11:37 AM
10-13-2017
11:37 AM
Customer has migrated from older versions of ACS, and has a number of dACLs defined (600). These dACLs are tied to internal user database per user (3000 users sharing the 600 dACLs). They then migrated to ISE - ok. Now they want to add posture for RA VPN. It worked for normal AAA.. But when they tried to add posture it breaks, because the CoA seems not not work applying dACLs via ACLs tied to the internal user database. TAC says this not supported. I am looking for creative workarounds, to still be able to leverage the configuration of 600 dACLs tied to useres in the internal ISE database.
... View more
- Tags:
- ise
Labels:
Created by
hnohre
in Network Access Control
in Network Access Control
09-20-2017
11:09 AM
09-20-2017
11:09 AM
Thanks!
... View more
Created by
hnohre
in Network Access Control
in Network Access Control
09-20-2017
10:46 AM
09-20-2017
10:46 AM
Does ISE onboarding support HSM for cert storage (Windows) (I guess this is not supported but have to ask)
... View more
Labels:
Created by
hnohre
in Network Access Control
in Network Access Control
09-20-2017
10:25 AM
09-20-2017
10:25 AM
Sorry need to follow up. Customer runs ISE 2.0 and in that release there is no ANC visible through the ISE GUI. But I know we still had the old quarantinebyIP working in that release however undocumented. Does the customer have t upgrade from ISE 2.0 to ISE 2.2 to be able to use RESTFUL API to unquarantine?
... View more
Created by
hnohre
in Network Access Control
in Network Access Control
09-19-2017
08:39 AM
09-19-2017
08:39 AM
So the only way this API is documented is on the ISE itself when logging in to the ise:8060/ers/sdk URL?
... View more
Created by
hnohre
in Network Access Control
in Network Access Control
09-19-2017
08:16 AM
09-19-2017
08:16 AM
Hi But I don’t find any documentation of the ANC API: quarantinebyIP and unqurantinebyIP in this doc? Hakan
... View more
09-19-2017
05:09 AM
This was answered on this thread ISE REST API functions for EPS ? but the links here are broken? Want to use Restful API (just python) to do quarantine, unquarantine and view quarantined IPs/devices.
... View more
Labels:
05-15-2019
I have a python app using ISE pxGrid interface. It used to work fine a
while ago, but something chan...
10-22-2018
Thanks. I am sure I can remove the stale sessions as per your
suggestion. But is there meaning of th...
10-21-2018
When scripting to ISE pxGrid interface I find that - if I use the
/getSessions API point I retrieve ...
10-21-2018
When querying the pxGrid sessions interface I get quite a few more
entries than I do from the ISE GU...
Created by
hnohre
in Network Access Control
12-17-2017
12-17-2017
Thanks Craig,I have read those documents, but I find them still out of
date with the latest post-Den...
Created by
hnohre
in Network Access Control
12-15-2017
12-15-2017
Can I have a pointer to IOS XE (Denali and later) configuration
examples/guides for ISE integration?...
Created by
hnohre
in Network Access Control
10-13-2017
10-13-2017
Hi HsingThis is the same thing - but only almost.For the customer it
works for the first authz - put...
Created by
hnohre
in Network Access Control
10-13-2017
10-13-2017
Customer has migrated from older versions of ACS, and has a number of
dACLs defined (600).These dACL...
Created by
hnohre
in Network Access Control
09-20-2017
09-20-2017
Does ISE onboarding support HSM for cert storage (Windows)(I guess this
is not supported but have to...
09-20-2017
Sorry need to follow up.Customer runs ISE 2.0 and in that release there
is no ANC visible through th...
09-19-2017
So the only way this API is documented is on the ISE itself when logging
in to the ise:8060/ers/sdk ...
09-19-2017
HiBut I don’t find any documentation of the ANC API: quarantinebyIP and
unqurantinebyIP in this doc?...
Public Statistics
| Date Registered | 09-10-2009 04:27 AM |
| Date Last Visited | 04-01-2020 04:53 AM |
| Total Messages Posted | 16 |
| Total Helpful Votes Received | 3 |
