Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About jkanclirz2
Stats
Member since
11-15-2015
39
Posts
15
Helpful
0
Solutions
Created by
jkanclirz2
in VPN and AnyConnect
in VPN and AnyConnect
01-14-2020
02:56 PM
01-14-2020
02:56 PM
Awesome - and very last thing as I do not see it referenced in Always-ON solution. Does the Always-ON / autoconnect solution effects ISE Posture and its compliance/posture module at all? Or business as usual, AnyConnect starts using user SSL cert and then posture happens next. I would assume that IF user fails posture with always-ON in place, it would LOOP for ever trying to VPN?
... View more
Created by
jkanclirz2
in VPN and AnyConnect
in VPN and AnyConnect
01-14-2020
02:38 PM
01-14-2020
02:38 PM
OK so no SSO with AD credentials is supported by AnyConnect VPN (even later/current versions). Q: Assuming - you're talking about USER certificate not machine cert for user initiated auto connect VPN (and then using machine type cert for the VPN - Management Tunnel feature). Any possible FUTURE known versions or adding any other modules hat would support caching of AD credentials and re-using it as SSO for VPN? Thanks.
... View more
Created by
jkanclirz2
in VPN and AnyConnect
in VPN and AnyConnect
01-14-2020
02:01 PM
01-14-2020
02:01 PM
Hey RJI To clarify for A) AD+MFA would ONLY be used for WIN10 Login. Then for the user VPN - user would then ONLY use AD login credentials and hopefully this would happen automatically and in background using the AD credentials user used to login.
... View more
Created by
jkanclirz2
in VPN and AnyConnect
in VPN and AnyConnect
01-14-2020
11:35 AM
01-14-2020
11:35 AM
Hi team, Trying to find some validation/documentation around this solution: ISE: 2.6 VPN: 4.5&4.7 AnyConnect with ISE Posture/Compliance module MFA: Microsoft's MFA Authentication System: Windows10 Desired solution outcome A) User will login into windows10 PC using AD credentials and Microsoft's MFA. When successful login - initiate VPN AnyConnect client to automatically use the AD credentials entered to login into the PC and automatically login / initiate VPN and its Posture modules (currently done via compliance module using ISE). Basically SSO solution. Desired solution outcome B) Computer boots up and AnyConnect 4.7 initiates VPN Management Tunnel (feature of 4.7) connection to HQ and connects to AD. At the same time while system is connected via Management Tunnel, it may contacted by SCCM and other tools on the HQs management network and system/application patches can be pushed to PC as needed. At some point user will LOGIN to the PC using AD credentials and Microsoft's MFA. When this happens - then the VPN Management Tunnel is disconnected and AnyConnect user connection (again with cached credentials) (Single-Sign-ON) is initiated and auto connected this time as USER to HQ's VPN. Looking for validation, issues, challenges and support for these outcomes. Appreciate your feedback!
... View more
Labels:
Created by
jkanclirz2
in VPN and AnyConnect
in VPN and AnyConnect
01-13-2020
11:33 PM
01-13-2020
11:33 PM
Hey team ISE: 2.3 VPN: 4.7 Any one aware of possibility of first connecting to the network via VPN as user and have compliant assumed status (meaning user will have full access) THEN start the compliance check (in background) - if it comes back as not compliant, switch the user from full to noncompliant access. Right now when posture is run on VPN you have the posture unknown state which is the REDIRECT ACL on ASA to allow users hit ISE PSNs. I'm wondering if there is a way to not redirect only the module when it needs to talk to the PSN but allow users fully on DURING the posture scan. Thanks!
... View more
Labels:
Created by
jkanclirz2
in VPN and AnyConnect
in VPN and AnyConnect
01-13-2020
11:21 PM
01-13-2020
11:21 PM
Question on the new feature in 4.6 Management VPN Tunnel. Is there anyway to integrate this with ISE Posture/Compliance module? Example - only pre-connect PC via Anyconnect Management VPN Tunnel IF that PC has latest patches. Just like you could do with user initiated VPN tunnels. Thanks
... View more
Labels:
Created by
jkanclirz2
in Security Documents
in Security Documents
12-13-2018
07:53 AM
12-13-2018
07:53 AM
Great - thank you for your comments/feedback and clarification. As a follow up to the SCCM/ISE (without MDM) use case, will ISE posture/anyconnect client actually trigger the client to CHECK with SCCM during posture unknown state OR does it solely rely on the client's ability to check (pending what GPO / how often timer is configured).
Use case 3: patching based on 'registry key' . Possible to check patch based on registry value key and then have remediation install ALL missing patches? Would this work or again - based on my 1st comment - can ISE anyconnect client trigger sccm client to check with sccm server because its missing certain condition (in this case reg key for patch).
Thank you.
... View more
Created by
jkanclirz2
in Security Documents
in Security Documents
12-09-2018
06:28 PM
12-09-2018
06:28 PM
Nice work - question: is the MDM/SCCM integration on ISE required? Can it be used without it to still validate if patches are missing? Per TAC - the whole MDM integration wasn't needed for patch validation. So that once anyconnect client with posture module connects via VPN, ISE will wait for client to talk to SCCM server and if it detects that the client received missing patches pop-out it'll react.
... View more
Created by
jkanclirz2
in Email Security
in Email Security
06-24-2018
01:33 PM
06-24-2018
01:33 PM
Looks like I just needed to do 'multiple' upgrades. I now see the 9.7.2 versions after initial upgrade of the VEs to 9.7.1
... View more
Created by
jkanclirz2
in Email Security
in Email Security
06-24-2018
12:59 PM
06-24-2018
12:59 PM
Hi,
Run into a challenge. The VMs (C100V) are showing upgrade options:
9.7.1 build 066 (latest)
The new C390s upgrade options for 9.x code showing:
9.7.2 (Build 065 or 131).
Not sure why the VMs are giving me different code options here and I'm not even seeing 10.x or 11.x. Would it be that its C100V and I needed to download the C300V?
Per earlier responses - I'm hoping to bring the VM (transition BOX) and the new C390 on the same code levels (9.x) so I can import/export configs between them. Then I'll upgrade C390 to 10.x or 11.x as needed.
... View more
Created by
jkanclirz2
in Email Security
in Email Security
06-06-2018
11:38 AM
06-06-2018
11:38 AM
Hi Libin,
Thank you for your input. Is there any official Cisco documentation that talks about this procedure and perhaps lists the versions from/to in which case this would be necessary and supported?
Also - as these are 'physical' appliances - will there be any issues porting configs between VM and Physical?
Step1: Deploy VM same code as the old C360
Step2: export configs from old C360 into the VM
Step3: upgrade VM to latest code
Step4: export VM's config to new C390
... View more
06-04-2018
02:46 PM
Hi Team, looking for good C360 to C390 best practices or if anyone has successfully done this and on which code levels. I'm finding x70 migration documentations but no luck yet o x60 to x90.
Thanks for any feedback!
... View more
Labels:
12-01-2015
09:23 AM
This worked. I copied it to the dir and also updated name of the wso file.
Thanks!
... View more
11-30-2015
10:05 PM
Update:
Cisco's POV (auto provisioned portal) looks like it assigned me proxy IPs that are NOT on the proxy list on default web mod editor profile.
Did the following (but still didn't help)
1) updated xml file and removed all <tower> but left one that was assigned to me by the portal. I've also updated the tower name to something different and updated <default> to reflect this change.
2) re-opened in editor and saved into .wso
3) uninstall/reboot/re-install
SAME ISSUE
But I did notice in Web Security - Preferences section, that not even the name changed of the tower. SO - it seems as this thing just isn't taking my profile during install!? Can I just copy it somewhere where it needs to go after install like you can with VPN profile?
I be happy to send you the xml file if anyone likes to try it.
... View more
11-30-2015
08:27 PM
Company key is active. I have also tried with user keys. They are also active.
Yes .wso is the extension - I've copied both .wso and the .xml file just to make sure into the /Profiles/websecurity installation dir.
After the install - I'm not even seeing my *.wso file anywhere in the C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Web Secuirty directory. Which I'm assuming that is where it needs to be after the Installation.
Thanks.
... View more
Created by
jkanclirz2
in VPN and AnyConnect
01-14-2020
01-14-2020
Awesome - and very last thing as I do not see it referenced in Always-ON
solution. Does the Always-O...
Created by
jkanclirz2
in VPN and AnyConnect
01-14-2020
01-14-2020
OK so no SSO with AD credentials is supported by AnyConnect VPN (even
later/current versions). Q: As...
Created by
jkanclirz2
in VPN and AnyConnect
01-14-2020
01-14-2020
Hey RJI To clarify for A) AD+MFA would ONLY be used for WIN10 Login.
Then for the user VPN - user wo...
Created by
jkanclirz2
in VPN and AnyConnect
01-14-2020
01-14-2020
Hi team,Trying to find some validation/documentation around this
solution:ISE: 2.6VPN: 4.5&4.7 AnyCo...
Created by
jkanclirz2
in VPN and AnyConnect
01-13-2020
01-13-2020
Hey teamISE: 2.3VPN: 4.7 Any one aware of possibility of first
connecting to the network via VPN as ...
01-13-2020
Question on the new feature in 4.6 Management VPN Tunnel. Is there
anyway to integrate this with ISE...
Created by
jkanclirz2
in Identity Services Engine (ISE)
11-20-2019
11-20-2019
There is nothing to block - it didn't even DETECT it. Right now - this
is a serious flaw with ISE. A...
Created by
jkanclirz2
in Identity Services Engine (ISE)
11-14-2019
11-14-2019
You bring up a good point. So the good guy was connecting to SWITCH1
(managed) and the bad guy was c...
Created by
jkanclirz2
in Identity Services Engine (ISE)
11-14-2019
11-14-2019
Having the same issues on dot1x workstations that have machine cert
validation AND AD membership val...
Created by
jkanclirz2
in Identity Services Engine (ISE)
10-09-2019
10-09-2019
Hi,As customer will NOT approve snmpv2 (only v3), which we hoped to
profile Cisco ASAs connecting to...
12-13-2018
Great - thank you for your comments/feedback and clarification. As a
follow up to the SCCM/ISE (with...
12-09-2018
Nice work - question: is the MDM/SCCM integration on ISE required? Can
it be used without it to stil...
11-27-2018
Actually - looks like ANY switch including Cisco's 300s series. I'm
wondering if this is even a supp...
11-27-2018
HI, Here is my Scenario: 3750/2960/3850 --> PHONE -> Desktop Switch
(Linksys or dump switch) -> Work...
Public Statistics
| Date Registered | 11-15-2015 12:06 PM |
| Date Last Visited | 01-15-2020 01:46 PM |
| Total Messages Posted | 39 |
| Total Helpful Votes Received | 15 |
