About Rob Ingram

Rob Ingram · 03-03-2024

Any ThousandEyes training or certifications planned?

Rob Ingram · 07-24-2026

@parthrawat979 The ISE Wired Prescriptive Guide will cover all the switch related AAA commands for ISE https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515 the AAA commands haven't...

Rob Ingram · 07-23-2026

@CHISHIUNG DPD should always be enabled on VPN peers, that will remove a stale SA to a peer if loss of connectivity.

Rob Ingram · 07-23-2026

@zain-3-4 create the Endpoint Identity Group, add the MAC addresses. Edit your authorisation rule and add a condition "IdentityGroup:Name EQUALS GROUPNAME" and ExternalGroup EQUALS DOMAINNAME/OU/Group

Rob Ingram · 07-23-2026

@zain-3-4 Typically you would not bother with doing a MAC lookup and AD authentication, as you would have to manually update the MAC group membership and MAC addresses can easily be spoofed. You could group the MAC addresses in ISE. In the authorisat...

Rob Ingram · 07-22-2026

@KayaaKashyap not with a policy based VPN, no. If you use a VTI (route based VPN) then you can use a loopback interface for the tunnel source, the IP address assigned to the loopback could be from a different subnet than assigned to the outside inter...

Member Since	‎12-05-2010 06:35 AM
Date Last Visited	‎06-30-2026 02:12 PM
Posts	11,248
Total Helpful Votes Received	17452

User Statistics

User Activity

Any ThousandEyes training or certifications planned?

Re: Cisco ISE for beginners

Re: Regarding IPsec SA Mismatch Events

Re: ISE Identity Services Engine authentication method

Re: ISE Identity Services Engine authentication method

Re: S2S VPN on Cisco FTD