Cisco ISE 1.2 AD Auth and Internal Auth on Same SSID?

Hello everyone... I'm fairly new to Cisco ISE 1.2 and am looking to try and setup a certain configuration. I'm trying to figure out how to create what amounts to a BYOD dmz'd wireless network that is PEAP based (or tls) but authenticates known users (employees from AD groups) but for users not found in those AD groups uses the internal user database and/or Web Auth? Make sense?
So, I of course can get the Authentication/Authorization policies configured for PEAPTLS and make to AD based on group and provide a VLAN number. No problem... I'm having trouble wrapping my head around how to combine the internal users or web auth users in this mix on the same ssid? I know by reading the ISE statement that the authentication policy if PEAP/TLS, ect is used, then a user not found is rejected and does not continue... Can someone provide an example as to how to accomplish this?
As a side note in 1.2, is there the ability to limit the number of consective logins as in ACS, outside of guess access only? What about in 1.3, which makes me nervous to upgrade in reading the instructions and the 'newness' of it.
Thank you for any help, it's greatly appreciated.

I'd like to confirm if the required changes in the VM server were
made, as there are a few changes in the ISE OS. The changes required are
listed in the release notes, under "VMware Operating System to be
Changed to RHEL 5 (64-bit)". Here's a direct link to the relevant section:
http://www.cisco.com/en/US/docs/security/ise/1.2/release_notes/ise12_rn.html#wp384531
Other causes can be :-
certificate issue on ISE or not enough disk space.

Similar Messages

HTTP Basic Auth and Proxy Auth

Hi,
i have a problem with the authentication against a proxy server and against a content provider. At first I have to authenticate against the proxy to get "free internet". The next step is to authenticate against the content provider to get a html or xml file.
The following source code runs very good in Eclipse, i.e. as JUnitTest. But If I execute the same code within a weblogic server, I will get an error (not authenticated). I believe I get this message from the content provider and not from the proxy because If I test this code within the weblogic server and with no authentication (i.e. google needs no authentication), I will get a valide xml/html file.
StringBuffer sb = new StringBuffer();
          SimpleAuthenticator simple = new SimpleAuthenticator("joeuser","a.b.C.D"); //from openbook
          Authenticator.setDefault(simple);
          String strUrl = "http://www.rahul.net/joeuser/";
          URL url = null;
          try {
               url = new URL(strUrl);
          } catch (MalformedURLException e) {
               // TODO Auto-generated catch block
               e.printStackTrace();
          URLConnection conn = null;
          InetSocketAddress addr = new InetSocketAddress("proxy.domain",8080);
          Proxy proxy = new Proxy(Proxy.Type.HTTP, addr);
          try {
               conn = url.openConnection(proxy);
          } catch (IOException e) {
               // TODO Auto-generated catch block
               e.printStackTrace();
          String proxyStr = "username" + ":" + "passwordl";
          String encoded = new String(Base64.encodeBase64(proxyStr.getBytes()));
          conn.setRequestProperty("Proxy-Authorization", "Basic " + encoded);
          // get http status code which is located in header field 0
          String status = conn.getHeaderField(0);
          if (status.contains("200")) {
               BufferedReader in = null;
               try {
                    in = new BufferedReader(new InputStreamReader(conn.getInputStream(),
                              "ISO-8859-1"));
                    String inputLine;
                    while ((inputLine = in.readLine()) != null) {
                         sb.append(inputLine);
                    in.close();
               } catch (UnsupportedEncodingException e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
               } catch (IOException e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
          else {
               System.out.println("Error");
          System.out.println(sb.toString());
public class SimpleAuthenticator
extends Authenticator
     private String username,
     password;
     public SimpleAuthenticator(String username,String password)
          this.username = username;
          this.password = password;
     protected PasswordAuthentication getPasswordAuthentication()
          return new PasswordAuthentication(
                    username,password.toCharArray());
Does somebody know a solution? I need the authentication against proxy and content provider in "one application".
Thank you very much,
André

I typically have used Apache Commons HttpClient for anything but trivial URL connections, and especially when combining both basic auth and proxy auth. When you use it, be aware of the "preemptive authentication" flag. One server I worked with didn't send the correct parameters back on particular requests, so I had to turn on this flag to get it to work.

Self-Registration Portal Cisco ISE 1.3 Keeps Going Back to Auth Page

We upgraded our Cisco ISE from 1.2.x to 1.3.x. The migration was successful, and everything appears to be correct. I see that our customized portals were brought over as well. We've created a new customized guest portal. We've updated the authorization profile to reflect the new portal. When a user goes through the process of registering, they register successfully, and then use the registration information to sign in successfully. However, when they attempt to browse to a web page, they are redirected right back to the authentication page. I've checked the SSID. It's set for L2 mac-filtering, Radius NAC, and for our ISE ACL. For the authentication security, CoA is enabled. When the upgrade was completed, I did follow all of the post-migration tasks. Can anyone give me any ideas why users are being redirected right back to the auth screen, once successfully authenticating, and not able to get to any internet sites? Thanks for your help!

Salodh,
Thank you so much for the quick reply! Please find the export below:
<?xml version="1.0" encoding="UTF-8"?>
@namespace html url(http://www.w3.org/1999/xhtml); :root { font:small Verdana; font-weight: bold; padding: 2em; padding-left:4em; } * { display: block; padding-left: 2em; } html|style { display: none; } html|span, html|a { display: inline; padding: 0; font-weight: normal; text-decoration: none; } html|span.block { display: block; } *[html|hidden], span.block[html|hidden] { display: none; } .expand { display: block; } .expand:before { content: '+'; color: red; position: absolute; left: -1em; } .collapse { display: block; } .collapse:before { content: '-'; color: red; position: absolute; left:-1em; }
<Root>

<PolicySets> <PolicySet name="Wired" description=""> <Conditions relationship="OR"> <Condition name="Wired_MAB" type="REUSABLE_COMPOUND"/> <Condition name="Wired_802.1X" type="REUSABLE_COMPOUND"/> </Conditions> <Authentication> <rules> <rule name="Default" status="Enabled"> <Conditions/> <Result name="Default Network Access" type="AllowedProtocolServices"/> <IdentitySourceRules> <rule name="Default" status="Enabled"> <Conditions/> <IdentitySourceResult name="Internal Endpoints"> <IdentitySource name="Internal Endpoints" type="IdentityStore"/> <AuthenFailed>REJECT</AuthenFailed> <UserNotFound>CONTINUE</UserNotFound> <ProcessFailed>DROP</ProcessFailed> </IdentitySourceResult> </rule> </IdentitySourceRules> </rule> </rules> </Authentication> <Authorization> <StandardRules> <rule name="Default" status="Enabled"> <Conditions/> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="PermitAccess" type="Standard"/> </rule> </StandardRules> <LocalExceptionRules/> </Authorization> </PolicySet> <PolicySet name="Wireless" description=""> <Conditions relationship="OR"> <Condition name="Wireless_MAB" type="REUSABLE_COMPOUND"/> <Condition name="Wireless_802.1X" type="REUSABLE_COMPOUND"/> </Conditions> <Authentication> <rules> <rule name="Wireless Users" status="Enabled"> <Conditions relationship="AND"> <Condition name="Wireless_802.1X" type="REUSABLE_COMPOUND"/> </Conditions> <Result name="Default Network Access" type="AllowedProtocolServices"/> <IdentitySourceRules> <rule name="Default" status="Enabled"> <Conditions/> <IdentitySourceResult name="AD1"> <IdentitySource name="AD1" type="IdentityStore"/> <AuthenFailed>REJECT</AuthenFailed> <UserNotFound>REJECT</UserNotFound> <ProcessFailed>DROP</ProcessFailed> </IdentitySourceResult> </rule> </IdentitySourceRules> </rule> <rule name="Default" status="Enabled"> <Conditions/> <Result name="Default Network Access" type="AllowedProtocolServices"/> <IdentitySourceRules> <rule name="Default" status="Enabled"> <Conditions/> <IdentitySourceResult name="Internal Endpoints"> <IdentitySource name="Internal Endpoints" type="IdentityStore"/> <AuthenFailed>REJECT</AuthenFailed> <UserNotFound>CONTINUE</UserNotFound> <ProcessFailed>DROP</ProcessFailed> </IdentitySourceResult> </rule> </IdentitySourceRules> </rule> </rules> </Authentication> <Authorization> <StandardRules> <rule name="Internal-Users-KMTMACHINE" status="Enabled"> <Conditions relationship="AND"> <Condition name="WLAN-User" type="REUSABLE_COMPOUND"/> </Conditions> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="WLAN-PERMITALL" type="Standard"/> </rule> <rule name="Internal-Users-MDM" status="Enabled"> <Conditions relationship="AND"> <Condition name="WLAN-User" type="REUSABLE_COMPOUND"/> <Condition name="WLAN-UserMDM" type="REUSABLE_COMPOUND"/> </Conditions> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="WLAN-PERMITALL" type="Standard"/> </rule> <rule name="Internal-Users-NONMDM1" status="Enabled"> <Conditions relationship="AND"> <Condition name="WLAN-User" type="REUSABLE_COMPOUND"/> <Condition name="WLAN-NotMDM" type="REUSABLE_COMPOUND"/> </Conditions> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="WLAN-PERMITONLYINTERNET" type="Standard"/> </rule> <rule name="Guest" status="Enabled"> <Conditions relationship="AND"> <Condition type="ADHOC">DEVICE:Device Type EQUALS All Device Types#Wireless</Condition> </Conditions> <identityGroups> <identityGroup name="Guest" type="User Identity Groups"/> </identityGroups> <Result name="Internet-Only" type="Standard"/> </rule> <rule name="Guest-CWA" status="Enabled"> <Conditions relationship="AND"> <Condition type="ADHOC">DEVICE:Device Type EQUALS All Device Types#Wireless</Condition> </Conditions> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="Guest-CWA" type="Standard"/> </rule> <rule name="Default" status="Enabled"> <Conditions/> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="DenyAccess" type="Standard"/> </rule> </StandardRules> <LocalExceptionRules/> </Authorization> </PolicySet> <PolicySet name="Default" description="Default Policy Set"> <Conditions/> <Authentication> <rules> <rule name="MAB" status="Enabled"> <Conditions relationship="OR"> <Condition name="Wired_MAB" type="REUSABLE_COMPOUND"/> <Condition name="Wireless_MAB" type="REUSABLE_COMPOUND"/> </Conditions> <Result name="Default Network Access" type="AllowedProtocolServices"/> <IdentitySourceRules> <rule name="Default" status="Enabled"> <Conditions/> <IdentitySourceResult name="Internal Endpoints"> <IdentitySource name="Internal Endpoints" type="IdentityStore"/> <AuthenFailed>REJECT</AuthenFailed> <UserNotFound>REJECT</UserNotFound> <ProcessFailed>DROP</ProcessFailed> </IdentitySourceResult> </rule> </IdentitySourceRules> </rule> <rule name="Dot1X" status="Enabled"> <Conditions relationship="OR"> <Condition name="Wired_802.1X" type="REUSABLE_COMPOUND"/> <Condition name="Wireless_802.1X" type="REUSABLE_COMPOUND"/> </Conditions> <Result name="Default Network Access" type="AllowedProtocolServices"/> <IdentitySourceRules> <rule name="Default" status="Enabled"> <Conditions/> <IdentitySourceResult> <IdentitySource name="Internal Users" type="IdentityStore"/> <AuthenFailed>REJECT</AuthenFailed> <UserNotFound>REJECT</UserNotFound> <ProcessFailed>DROP</ProcessFailed> </IdentitySourceResult> </rule> </IdentitySourceRules> </rule> <rule name="Default" status="Enabled"> <Conditions/> <Result name="Default Network Access" type="AllowedProtocolServices"/> <IdentitySourceRules> <rule name="Default" status="Enabled"> <Conditions/> <IdentitySourceResult> <IdentitySource name="Internal Users" type="IdentityStore"/> <AuthenFailed>REJECT</AuthenFailed> <UserNotFound>REJECT</UserNotFound> <ProcessFailed>DROP</ProcessFailed> </IdentitySourceResult> </rule> </IdentitySourceRules> </rule> </rules> </Authentication> <Authorization> <StandardRules> <rule name="Wireless Black List Default" status="Enabled"> <Conditions relationship="AND"> <Condition name="Wireless_Access" type="REUSABLE_COMPOUND"/> </Conditions> <identityGroups> <identityGroup name="Blacklist" type="Endpoint Identity Groups"/> </identityGroups> <Result name="Blackhole_Wireless_Access" type="Standard"/> </rule> <rule name="Profiled Cisco IP Phones" status="Enabled"> <Conditions/> <identityGroups> <identityGroup name="Cisco-IP-Phone"/> </identityGroups> <Result name="Cisco_IP_Phones" type="Standard"/> </rule> <rule name="Profiled Non Cisco IP Phones" status="Enabled"> <Conditions relationship="AND"> <Condition name="Non_Cisco_Profiled_Phones" type="REUSABLE_COMPOUND"/> </Conditions> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="Non_Cisco_IP_Phones" type="Standard"/> </rule> <rule name="Default" status="Enabled"> <Conditions/> <identityGroups> <identityGroup name="Any"/> </identityGroups> <Result name="PermitAccess" type="Standard"/> </rule> </StandardRules> <LocalExceptionRules/> </Authorization> </PolicySet> <GlobalExceptions> <rules/> </GlobalExceptions> </PolicySets>

<ReusableConditions> <Authentication> <Compound> <condition name="Wired_MAB" description="A condition to match MAC Authentication Bypass service requests from Cisco Catalyst Switches" relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Call Check</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Ethernet</Condition> </condition> <condition name="Wireless_MAB" description="A condition to match MAC Authentication Bypass service requests from Cisco Wireless LAN Controller" relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Call Check</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Wireless - IEEE 802.11</Condition> </condition> <condition name="Wired_802.1X" description="A condition to match an 802.1X based authentication requests from Cisco Catalyst Switches" relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Framed</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Ethernet</Condition> </condition> <condition name="Wireless_802.1X" description="A condition to match an 802.1X based authentication request from Cisco Wireless LAN Controller" relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Framed</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Wireless - IEEE 802.11</Condition> </condition> <condition name="Switch_Local_Web_Authentication" description="A condition to match authentication requests for Local Web Authentication from Cisco Catalyst Switches" relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Outbound</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Ethernet</Condition> </condition> <condition name="WLC_Web_Authentication" description="A condition to match authentication requests for Web Authentication from Cisco Wireless LAN Controller" relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Login</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Wireless - IEEE 802.11</Condition> </condition> </Compound> </Authentication> <Authorization> <Compound> <condition name="Wired_802.1X" description="Default condition used to match an 802.1X based authentication requests from Cisco Catalyst Switches." relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Framed</Condition> <Condition type="ADHOC">Radius:NAS-Port-Type EQUALS Ethernet</Condition> </condition> <condition name="Wired_MAB" description="Default condition used to match MAB Authentication Bypass service requests from Cisco Catalyst Switches." relationship="AND"> <Condition type="ADHOC">Radius:Service-Type EQUALS Call Check</Condition> <Condition type="

Cisco ISE 1.1.4 Patch 7 (Internal Endpoint Mac Addresses Getting Disppeared)

Hi Folks,
I am having issue that mac addresses which we are trying to add under Internal Endpoint Group for MAB getting disappear automatically after few minutes. We tried multiple mac addresses but result same. We can see the mac address which we added earlier but new mac address getting disappear. Is there any limit to add mac address under Internal Endpoint. We have following licenses.
L-ISE-ADV-1K-M= Cisco ISE 1000 EndPoint Advanced + Base Migration License
Thanks

Tabish,
We'll update the latest patch and then look for the work around from any one of our Cisco experts

Cisco WLC + ACS + AD for Machine AND User auth...

So I am trying to implement an SSID that requires a machine to be a domain member, AND require the user to provide username/password credentials before being allowed on that SSID.
I am reading that it is possible, but can't find a clear config on how it is supposed to be setup... read about Machine Access Restrictions as being part of the config.
Any help here?
WLC 7.6 and ACS 5.5
-g

We are testing ISE with EAP chaining. It allows you to validate the company device (laptop) is joined to the domain and then the user credentials. However this requires EAP-FAST and the Cisco Anyconnect client. There is a group set up to look at EAP-TEAP. This will allow for standardize "chaining"
http://tools.ietf.org/html/draft-ietf-emu-eap-tunnel-method-01#page-5

AC 5.3 RAR - combined risk analysis reports for regular auth. and SPM auth.

Dear All,
we have users that have regular day-today authorization and also FF authorization.
Does the Batch Risk Analysis takes into account both authorizations when doing the risk analysis for those users ? will we see it in the reports ?
Thanks
Yudit

ok, so basically the answer is no, in the RAR components we do not have risk analysis for the combinations of the roles assigned to the user and to his FF ID.
in that case, at what stage does the system checks for those combined risks ?
is it checked when we manage the risk analysis phase in the CUP request that is asking to assign the FF ID to the user ?
thanks
Yudit

Using the same Realm for passwd auth and ssl auth

Hi,
does someone can tell me if it's possible to use the same Realm to authenticate
some client with username,password and other client with certificates.In other
word can a same realm support 2 different authentication method
Thanks a lot
romain

Yes.
The AbstractListableRealm, which I assume you're extending,
has three methods:
authUserPassword :
checks passwords
authSSLCertificate :
is passed in the certificate verified by the SSL
handshake. The default implementation of this
method hands the certificate to the CertAuthenticator
(if there is one). The CertAuthenticator typically
uses one of the fields in the certificate to come up with
a user name (eg. the email address minus the @ stuff),
then verifies that there is a user with that name in
the realm. Since SSL verfied the certificate, this
method doesn't do any further checking. I think we
ship a SimpleCertAuthenticator sample that you can
look at.
authCertificates :
Like authSSLCertificates except that the certificate
came from someplace else. I'm not sure under what
conditions this is called.
Normally, the realm worries about the user/password
authentication then relies on the CertAuthenticator for
the certificate stuff. The CertAuthenticator maps the
certificate to a user name then goes to the realm to
make sure that there really is a user with that name.
-Tom
"romain" <[email protected]> wrote:
>
Hi,
does someone can tell me if it's possible to use the same Realm to authenticate
some client with username,password and other client with certificates.In
other
word can a same realm support 2 different authentication method
Thanks a lot
romain

Cisco ISE with EAP-FAST and PAC provisioning

Hi,
I have search with no result on this topic. So, Does anyone have implemented Cisco ISE authentication with EAP-FAST and PAC provisioning ?
Since I have an issue with internal proxy, user required to authenticate with an internal proxy before granting access to the internet.
If you have any documents, it would be appreciated for me.
Thanks,
Pongsatorn

From what I understand a Internet proxy PAC and a eap-fast PAC are two different purposes.
Is that what you are trying to get clarification on.
Basically eap fast PAC provisioning is a PAC that s provisioned when a client authenticates successfully. The client provides this PAC for network authentication and not proxy authentication.
Sent from Cisco Technical Support iPad App

Cisco ISE functionally and license

HI.
I wanna configure the following on Cisco ISE 1.2.1.
Self-registration portal for guests (SSID: guests)
802.1x user certificate check (Cisco NAM supplicant) for employees (SSID: Corporate) (EAP-TLS)
Self provisioning portal (to deploy BYOD certificate and give access for BYOD devices) for BYOD devices (SSID: Corporate) (PEAP, MSHAPv2)
Can I configure these things with PLUS license or do I need Adv or Wireless? I am not sure if one of these requires profiling functionally.

With plus license all the above items should work.
Here is what plus license supports:
Bring Your Own Device (BYOD)
Profiling
Endpoint Protection Service (EPS)
TrustSec SGT
For more info, refer ISE license section:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_license.html#41012
Regards,
Jatin Katyal
**Do rate helpful posts**

Cisco ISE guests and Ironport

Hi All,
I'm currently writing a HLD for a Cisco ISE rollout in my organization, and I've come across sort-of-an-issue:
I'm planning on getting the guests in through the ISE Guest portal, but I also want to push them through an authenticated proxy(for accounting purposes) instead of a transparent one... however, I can't seem to find a way to somehow integrate Ironport and ISE in order to achieve some sort of an SSO, to avoid users having to enter their credentials twice(guest portal and ironport)- has anyone got a working solution for this?
Any constructive input appreciated!
Thanks!

Thanks for the swift responses and suggestions!
I'll most certainly have a look at the proposals...
However, I still want the guest users to go through the S370, as it's not only for accounting purposes, but I want them to authenticate, since it would make tracing and pinning events to a person way easier - that's the main reason why I'm trying to find a solution that might act like an SSO. The business side stated that signing in twice(ISE guest portal, then proxy) is unacceptable. I know that there's no direct integration between ISE and Ironport at the moment, and I am going to put in a feature request for that, but for the time being, I am really keen on getting this to work somehow...
BTW - I'm currently using a virtualised ISE, release 1.1.4., And I've got the 3395's on order...

Cisco ISE doesn`t send packets to AD

Hello!
I`ve tried to configure authentication through AD. Intergation Cisco ISE with AD is successful and I can retrive all groups from AD. I`ve configured dot1X authentication (Policy>Authentication) to use at first AD, then Internal Users.I`ve configured the rule for one group in authorization policy (Policy>Authorization), I`ve added this group from AD (Administration> Identty Management> External Identity Sources> Active Directory> Groups).
When the user tries to connect to LAN and enters credentials from AD, Cisco ISE always uses only Internal Identity Source and doesn`t try to seach user in AD. I don`t see any packets to AD in Operations>Authentication and TCP Dump, Cisco ISE only checks Internal Identity Source.
Does anybody know how to solve this problem?
Thank you!

Problem was in wrong configuration Authentication.
Now I have the folowing problem, ISE can`t authenticate wired guest user through Central Web Access.
Guest Portal sends message about succeful authentication and after that redirect again in Guest Portal.
I have two rules in Policy>Authorization (attach: Auth).
In Operations>Authentication I see folowing (attach: Guest)
In defaultguestportal I have "Both" authentication and sequence from 3 Identity Stores (Intetnal Users, Internal Endpoint, AD)

Cisco ISE with Flex Connect ios 7.4

Hello my name is Ivan
I have a question:
Is possible to do a deployment with cisco ise (trust sec 2.0) and flex connect and web authentication to a cluster of cisco wlc (ios 7.4)?
There are a features or requeriments to configure this?
Regards
Ivan

By "cluster of cisco wlc" are you referring to the HA features for the 5508? HA or not should be irrelevant to the configuration of ISE w/ 7.4 WLC on flex connect.
Configuring CWA (central web auth) via L2/Mac-Filter and RADIUS NAC will require that you have a FlexConnect group built with the desired AP within the group. You will need to build FlexConnect ACLs and apply them to the FlexConnect group that correspond with the various NAC states the client will be in during the CWA process.
You will probably need 1 or 2 Web Policy ACLs
1. allow traffic to/from dns and ISE PSN
2. allow traffic to/from dns, ise and other resources (for instance for posturing/remediation)
Please note that you cannot "dynamically" assign ACLs to FlexConnect APs/Groups as part of the transition from central webauth reqd to RUN. The WebPolicies ACLs are the only ones that can override (think of them like pre-auth acls). Once you finally send back the access-accept for the client you can not apply dynamic acls to the particular wlan/vlan.
For instance if you needed differentiated access on a single network between guest and vendors, you couldn't send an access-accept back with an ACL for vendors vs an ACL for guests - in a FlexConnect environment. They would have to be placed on separate networks with their respective access.
It's possible this type of configuration (much desired) will be allowed in 7.5 whenever it rears its head.

Cisco ISE Active Endpoint Usage Reset

Hi,
I have a Cisco ISE running version 1.1 and I was wondering if it may be possible to reset the license usage/active endpoint shown on the dashboard? This was noticed after a restore of ISE due to replacement of hardware and I noticed that the license usage count/active endpoints does not seems to go down.
The following methods have been tried however without any success:
1. Reboot ise server/service
2. Disable all network devices making use of ise such that there are no clients/devices accessing it; example switch/wlc/etc...
3. Deleted all endpoints usage in identies/identies group
4. Disable profiling on ise
As the ise has been installed with a base license; not too sure if it may be either a bad restore (all service/application are working though) / bad radius accounting which does not timed out on the ise / etc...
Any help is appreciated on how to reset the active endpoint/license usage.
Thanks.

Here is a method for removing the stale records. Please give this a try:
http://www.cisco.com/en/US/docs/security/ise/1.1/api_ref_guide/ise_api_ref_ch2.html#wp1072950
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco ISE - General Info. & capabilities

Hello All,
I've read quiet a bit of ISE features, but would like to know the following:
1. Can ISE provide/track details of user activity, like which servers/websites he accessed over a period of time?
2. Can it provide details of how much data was transferred from a particular server to a specific client?
3. For a 1500 user env. (1000 desktops and 500 wireless devices) which model of ISE would be appropriate?
4. How would having ISE be different from already deployed authentication services like Active Directory or built-in application authentication for solutions like Oracle ERP systems?
5. I see ISE as being marketed primarily for wireles devices (BYOD), but how would it help for wired devices (or does it become and unecessary authentication level apart from AD, switch based 802.1x, etc)
Thank you.
Regards,
Adnan

Cisco ISE is a consolidated policy-based access control system that incorporates a superset of features available in existing Cisco policy platforms. Cisco ISE performs the following functions:
•Combines authentication, authorization, accounting (AAA), posture, and profiler into one appliance
•Provides for comprehensive guest access management for the Cisco ISE administrator, sanctioned sponsor administrators, or both
•Enforces endpoint compliance by providing comprehensive client provisioning measures and assessing device posture for all endpoints that access the network, including 802.1X environments
•Provides support for discovery, profiling, policy-based placement, and monitoring of endpoint devices on the network
•Enables consistent policy in centralized and distributed deployments that allows services to be delivered where they are needed
•Employs advanced enforcement capabilities including security group access (SGA) through the use of security group tags (SGTs) and security group access control lists (SGACLs)
•Supports scalability to support a number of deployment scenarios from small office to large enterprise environments
The following key functions of Cisco ISE enable you to manage your entire access network.
Provide Identity-Based Network Access
The Cisco ISE solution provides context-aware identity management in the following areas:
•Cisco ISE determines whether users are accessing the network on an authorized, policy-compliant device.
•Cisco ISE establishes user identity, location, and access history, which can be used for compliance and reporting.
•Cisco ISE assigns services based on the assigned user role, group, and associated policy (job role, location, device type, and so on).
•Cisco ISE grants authenticated users with access to specific segments of the network, or specific applications and services, or both, based on authentication results.
ISE 3315 can support 1500 users with appropriate license.

Cisco ISE 1.2 Ise Application doesn´t install

Hello,
I am trying to install Cisco ISE on a VMWare Paltform, and the installation goes OK for the ADE-OS (The Os is installed, but the ISE application doesn´t install.
Any Hint in how to solve that ?
BR,
Julio

Hi all,
Thank for your answers, the problem was that the ISO image on the Cisco software repository was corrupted. I finally did a md5 check, and downloaded the image 4 times.
The for images download matched the md5 checksums between themselves, but not the Cisco webpage. Finally a TAC engineer had to publish the image form me, and when downloaded from this link It matched the CCO md5 and it worked fine.
BR,
Julio.

Cisco ISE 1.2 AD Auth and Internal Auth on Same SSID?

Similar Messages

Maybe you are looking for