What is the ACL_WEBAUTH_REDIRECT configuration? ... View more

Hi, Can you advise on how you do the authentication policy on v2.3.   In the example above when creating the 3 rules for the authentication of external, travelling & local user it says set the Allowed Protocols to use proxy service: eduroam & PEAP-Auth but in v2.3 the authentication policy has the "Use" field where you can select internal endpoints, users & ID stores. ... View more

Great article. Can you expand a little on how to register ISE as our RADIUS server with the external RADIUS servers & does this mean ISE needs to be accessible from the internet? ... View more

We are not authenticating users to AD. The latency was occuring during the lookup of the endpoint in the internal endpoint store.   The final fix for this was to add a purge rule to our endpoint store. What had happened was as we are only in the early stages of rolling out ISE & using MAB authentication bypass over the last 6-9 months ISE had been profiling devices & adding them to the "profilled" internal endpoint store. Because we are a university with several campuses in & around a busy city many devices that had been profiled could have been passers by with devices that were seen by our APs, guest devices visiting campus not to mention all the devices owned by students & staff. Our internal profiled endpoint store had grown to over 80,000 devices.   When looking up devices that are part of our static MAB list it first was looking through this profiled list of 80,000 devices before getting to our MAB lists. After putting in a purge rule to remove devices that have been inactive for more than 5 days our profiled endpoint store reduced to less than 4000 devices. This solved the latency issue. ... View more