Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Ditter
Online
Ditter
Member since
07-03-2018
Beginner
04-15-2019
04:53 AM
Thank to all for their answers bout my "ptroblem". The solution was very simple, i had to unplug and plug again the stack cables , the message i got was the following: Please note that the cables were firm and not loose in any way. *** Stack cable authentication failed for cable inserted on stack port 1 on switch 1 *** Reloading chassis because cable auth failed on stack_port 1 Chassis 1 reloading, reason - stack cable authentication failed After that the two switches formed the stack.I am not sure if i can trust this , but i will do some more testings and let you know.
... View more
04-02-2019
11:59 AM
Hi Leo, not able at this point of time to post the output. I will let you know as soon as possible. Thank you all for your replies.
... View more
03-22-2019
06:15 AM
Hi to all, i have two 9300 , cross connected with the stacking cables but the stack does not come up. Should i do something prior to stacking in order this to take effect? T he only difference i noticed between these two 9300s is tb H/W version. In the first one it is : Switch/Stack Mac Address : 7001.b585.1800 - Local Mac Address Mac persistency wait time: Indefinite H/W Current Switch# Role Mac Address Priority Version State ------------------------------------------------------------------------------------- *1 Active 7001.b585.1800 1 V01 Ready and in the second one it is : Switch/Stack Mac Address : 7018.a7b1.a880 - Local Mac Address Mac persistency wait time: Indefinite H/W Current Switch# Role Mac Address Priority Version State ------------------------------------------------------------------------------------- *1 Active 7018.a7b1.a880 1 V02 Ready Apart from the above the software version and switch type is the same: Switch Ports Model SW Version SW Image Mode ------ ----- ----- ---------- ---------- ---- * 1 62 C9300-48P 16.6.5 CAT9K_IOSXE INSTALL and in the second one : Switch Ports Model SW Version SW Image Mode ------ ----- ----- ---------- ---------- ---- * 1 62 C9300-48P 16.6.5 CAT9K_IOSXE INSTALL Configuration register is 0x102 Any ideas? Thanks, Diiter.
... View more
- Tags:
- catalyst 9300
Labels:
Created by
Ditter
in Policy and Access
in Policy and Access
12-13-2018
04:49 AM
12-13-2018
04:49 AM
>"authentication event fail action next-method" - if first authentication method fails, try the next method if >configured. Useful if you are using dot1x and mab Still don't understand the meaning of the above command, as you can configure "authentication order mab dot1x webauth" and "authentication priority mab dot1x webauth" which (i think) try all methods in sequence.... so what the meaning of the "authentication event fail action next-method" Thanks.
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
12-13-2018
03:37 AM
12-13-2018
03:37 AM
Thanks. I also noticed that you can also configure the following interface commands: authentication event fail action next-method authentication event fail action authorize vlan How are these two commands above different from : authentication event server dead action authorize vlan Should they also be configured on the interface or the "authentication event server dead action authorize vlan" will suffice? Thanks, Ditter
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
12-12-2018
05:51 AM
12-12-2018
05:51 AM
Hi to all, just looking in these old threads about ISE getting dead and i would like to ask about the following command: authentication event server dead action authorize vlan vlan-id In case the port is already configured with access vlan i.e. vlan 50 do i need to configure the above command? Or the above command is needed in case you want to override the port configured access vlan? Thanks, Ditter.
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
10-10-2018
05:45 AM
10-10-2018
05:45 AM
Thank you for your followup.
I found out the culprit why the live log file was partially empty.
More specifically as i was trying to reduce the mass of logged messages, i accidentally erased LogCollector from passed authentication logging categories.
The strange thing was that i got Authentication Fail in the Live logs (the red circle with the x on it). When i
re-enabled the LogCollector the authentication succeeded again with the green tick box !! Please note that i did not change anything except from adding back the LogCollector in the Passed Authentication Category !
It seems to me more of a bug and not a normal behavior.
One idea would be the admin user not to be able to remove logcollector from this logging event.
Any ideas why there is this dependency between logcollector and authentication behavior?
Thank you,
Ditter
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
10-05-2018
04:50 AM
10-05-2018
04:50 AM
Any ideas why the Steps column in the ISE log is empty? What could be wrong?
Thanks.
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
10-04-2018
06:42 AM
10-04-2018
06:42 AM
in addition i do not see the aaa log in debug level menu, see attached
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
10-04-2018
06:37 AM
10-04-2018
06:37 AM
The problem is that the right side of the log window is blank ! I have nothing there....
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
10-04-2018
05:05 AM
10-04-2018
05:05 AM
Perhaps, it was not clear from my previous answer, the problem with this configuration is that the authentication fails, although the users logs in the switch. I would suppose that the ISE would show in the logs a green tickbox instead of a red circle as far as the authentication is concerned. The message that show in the logs is the following:
TACACS: TACACS+ will use the password prompt from global TACACS+ configuration which confuses me.
Thanks,
Ditter
... View more
Created by
Ditter
in Policy and Access
in Policy and Access
10-04-2018
03:55 AM
10-04-2018
03:55 AM
Dear All,
i am facing the following problem:
I have a basic TACACS+ configuration as far as the tacacs policy is concerned and is described in the attached PNG.
I also have a local user test and a network device.
Overview Request Type Authentication Status Fail Session Key tacacs-server/327859046/169 Message Text TACACS: TACACS+ will use the password prompt from global TACACS+ configuration Username test Authentication Policy Selected Authorization Profile Authentication Details Generated Time 2018-10-04 13:25:43.840000 +03:00 Logged Time 2018-10-04 13:25:43.841 Epoch Time (sec) 1538648743 ISE Node tacacs-server Message Text TACACS: TACACS+ will use the password prompt from global TACACS+ configuration Failure Reason Resolution Root Cause Username test Network Device Name Network Device IP 1.1.1.1 Network Device Groups Device Type Location Device Port tty3 Remote Address 192.168.1.2
TACACS Protocol Authentication Action Login Authentication Privilege Level 1 Authentication Type ASCII Authentication Service Login Other Attributes ConfigVersionId 86 Device Port 15896 MajorVersion Default MinorVersion Default Type Authentication Sequence-Number 1 Header-Flags Encrypted SessionId 2246432117 EnableSingleConnect false CiscoIOS false UseSingleConnect false SelectedAccessService Default Device Admin Sequence-Number 2 CPMSessionID 22464321171.1.1.115896Authentication2246432117 Response {AuthenticationResult=NotPerformed; }
Any ideas?
Ditter.
... View more
- Tags:
- ise
Labels:
09-07-2018
02:34 AM
Thank you all for your replies,
i was looking for a single command to provide all this info, for example in a catalyst 4500 with 192 ports it would be easier with one command to have the concurrent MAC addresses per port.
I finally recalled the way i did it in the past, but it is not so straight forward. First step is to activate port-security on per interface basis and then issue the command show port-security.
sw1#sh port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count) --------------------------------------------------------------------------- Gi2/21 10 1 0 Shutdown Gi2/22 10 0 0 Shutdown Gi2/23 10 0 0 Shutdown Gi2/24 10 1 0 Shutdown Gi2/25 10 1 0 Shutdown
Thank you all.
... View more
09-06-2018
06:45 AM
Hi to all,
i am trying to recall a show command that shows current count of mac addresses in a catalyst switch (IOS). I am not referring to command "show mac address-table) but a command that shows how many MAC addresses are active on FastEthernet 0/3 , FastEthernet 0/4 e.t.c.
I issued this command in the past but now i forgot it.
Thank you,
Ditter
... View more
Labels:
Created by
Ditter
in Policy and Access
in Policy and Access
08-03-2018
02:16 AM
08-03-2018
02:16 AM
So are we still hitting the bug CSCuz52877 even in ISE 2.4 (357) ?
... View more
yesterday
thanks for your answer. Not all my switches support device sensor , i
have many cat 4500 that do not...
yesterday
Hi to all, i wonder if you can help me in the following: I have two
cisco PSNs. Both of them are con...
04-15-2019 04:53 AM
Thank to all for their answers bout my "ptroblem". The solution was very
simple, i had to unplug and...
04-02-2019 11:59 AM
Hi Leo, not able at this point of time to post the output. I will let
you know as soon as possible. ...
03-22-2019 06:15 AM
Hi to all, i have two 9300 , cross connected with the stacking cables
but the stack does not come up...
Created by
Ditter
in Identity Services Engine (ISE)
03-19-2019 02:30 PM
03-19-2019 02:30 PM
Please refer to this attachment also:
Created by
Ditter
in Identity Services Engine (ISE)
03-19-2019 02:28 PM
03-19-2019 02:28 PM
Thanks Paul, my environment is very diverse , there is no active
directory and users are free to ins...
Created by
Ditter
in Identity Services Engine (ISE)
03-19-2019 08:34 AM
03-19-2019 08:34 AM
Hi to all, it seems that ISE has categorized around 70% of our network
endpoints as type MISC and 32...
Created by
Ditter
in Identity Services Engine (ISE)
03-14-2019 07:39 AM
03-14-2019 07:39 AM
Hi Paul ! so glad i am part of this community. You seem to know your
stuff :-) I had to patch the PS...
Created by
Ditter
in Identity Services Engine (ISE)
03-12-2019 02:55 AM
03-12-2019 02:55 AM
Thanks Mnagired, yes lldp and cdp are both configured and enabled to all
ports. The strange thing is...
Created by
Ditter
in Identity Services Engine (ISE)
03-06-2019 11:14 AM
03-06-2019 11:14 AM
Thanks Ognyan, to answer your first question , yes i am only using MAB
because i have two kinds of p...
Created by
Ditter
in Identity Services Engine (ISE)
03-05-2019 05:18 AM
03-05-2019 05:18 AM
Dear All, a quick question for which i would like to have your opinion.
I am using MAB Authenticatio...
Created by
Ditter
in Identity Services Engine (ISE)
02-27-2019 04:11 AM
02-27-2019 04:11 AM
Thanks Damien, i am a little bit confused about MAB in combination with
port security. Probably it d...
Created by
Ditter
in Identity Services Engine (ISE)
02-26-2019 05:40 AM
02-26-2019 05:40 AM
Hi to all, i have done some searching about this and i only found the
following thread:
https://comm...
Created by
Ditter
in Identity Services Engine (ISE)
01-09-2019 02:48 AM
01-09-2019 02:48 AM
Hi Mnagired, finally i have some good results and i would like to share
it with all. The steps i fol...
Public Statistics
| Date Registered | 07-03-2018 02:53 AM |
| Date Last Visited | 05-24-2019 05:32 AM |
| Total Messages Posted | 71 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "VIP Expert"){kind=icon}
