Cisco ise upgrading and licences

I nedd to upgrade from version 1.1.2 patch 4 to 1.1.3
the deployment is distributed so the split deployment technique needs to be used:
http://www.cisco.com/en/US/docs/security/ise/1.1.1/upgrade_guide/upg_dis_dep.html#wp1052969
the guide is quite hard to follow as there are some licensing informations missing that can potentially cause service downs:
in particular my questions reguarding the guide are:
--- OUR licence is registered to the primary PAN node only----
1) Deregistering primary PSN "D" node : what licence it will use? the inherited (10000 endpoints) or will it lose the licence completely and lock the network authentications?
2) When node "B" will be deregistered and will become standalone what happens to its licence ? will it be lost? and what will happen to the node "D" when added back to the node "B" ?
3) when I will switch back node "A" (after upgrade and registration to node "B") to its previous primary PAN state it is stated that the licence needs to be reloaded in it cause it was lost when adding it to node "B".... and in the meanwhile? no node will authenticate cause the primary node is without a licence?
TY

Giuliano,
De-registered node will always use it's own license, i.e. it becomes standalone box without knowledge or information of anything around it. Either the evalutaion or whichever license you have supplied it with.
License enforcement is performed by active admin node in cluster, according to its license.
Have a look at:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCug04405
I don't think license needs to be reloaded, but that may be just my memory not serving me. I'll double-check that one.
M.

Similar Messages

Cisco ISE functionally and license

HI.
I wanna configure the following on Cisco ISE 1.2.1.
Self-registration portal for guests (SSID: guests)
802.1x user certificate check (Cisco NAM supplicant) for employees (SSID: Corporate) (EAP-TLS)
Self provisioning portal (to deploy BYOD certificate and give access for BYOD devices) for BYOD devices (SSID: Corporate) (PEAP, MSHAPv2)
Can I configure these things with PLUS license or do I need Adv or Wireless? I am not sure if one of these requires profiling functionally.

With plus license all the above items should work.
Here is what plus license supports:
Bring Your Own Device (BYOD)
Profiling
Endpoint Protection Service (EPS)
TrustSec SGT
For more info, refer ISE license section:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_license.html#41012
Regards,
Jatin Katyal
**Do rate helpful posts**

Cisco ISE Admin and EAP certificate renewal

Hi board,
maybe I'm asking a rather dumb question here, but anyway :)
I'm currently thinking about how to renew an admin/EAP certificate on an ISE node and the effect on the endpoint authentication.
Here's the thing I do, when I initially install an ISE node
1.) CSR creation on ISE (PAN) - CN=$FQDN$ and SAN="fqdn as well"
2.) Sign CSR and bind certificate on ISE node - done
Now after 10 month or so (if the certificate is valid for one year) I want to renew the ISE admin/EAP certificate.
CSR creation: I cannot use the $FQDN$ as the CN, because there is still the current certificate (CN must be unique in the store, right?)
So what to do now? Do I really need to create a temporary SSC and make it the admin/EAP certificate, delete the current certificate and then create a new CSR? There must be a better and more important non-disruptive way of doing this.
How do you guys do this in your deployments?
Thanks in advance and sorry again if this is a silly question.
Johannes

you can install a new certificate on the ISE before it is active, Cisco recommends that you install the new certificate before the old certificate expires. This overlap period between the old certificate expiration date and the new certificate start date gives you time to renew certificates and plan their installation with little or no downtime. Once the new certificate enters its valid date range, enable the EAP and/or HTTPS protocol. Remember, if you enable HTTPS, there will be a service restart
Certificate Renewal on Cisco Identity Services Engine Configuration Guide
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116977-technote-ise-cert-00.html

Cisco ISE - Computer and User Authenticiation on AD for Wireless Clients.

Hello all,
I am trying to configure Cisco ISE to authenticate/authorize Wireless access with PEAP MsChapv2.
The AD user authorization works fine, but I cannot see on the logs a challenge for the computer verification (it must be a domain member).
I have found an attribute I would use for this action, but I cannot use it, because I don't see the challenge for the computer challenge.
Can you explain me if this fact is involved by the ISE configuration or by the client configuration ?
Thanks a lot for your help.
The followings screenshots show the logs appearing in the ISE :
Kind regards, Emeric.

This is a great question and I wanted to add my input and I have a question as well. My understanding in order to do both Machine and User EAP-Chaining is required, which used EAP-FAST.
In my testing, when a domain box is configured for computer/user authentication. When the laptop started up it will authenticate with a host/ and sid in the log.
When the user logs in you then see the user ID.
For my benefit when rule are you talking about ?
Thank you

Cisco ISE CLI and GUI password expire

I had Cisco ISE version 1.1 i face a problem with the CLI and GUI password, as it expire and i can't login, i do the password reset using the ISE DVD,
i navigate to the ISE CLI, and do the following commands:
conf t
     password-policy
          no password-expiration-enable
and reset the GUI admin password, using the command:
     # application reset-passwd ise admin
from the ISE GUI i had remove the option for diable admin account after 45 days.
but after 60 days the password expire again.
so kindly advise what to check for this expire issue.

Hi Mostafa,
Yes, the last reply was more towards GUI password-mgmt because in maority of cases it happens with UI admin account. I need to know if you've restarted the ISE after disabling the expiration from the CLI because what I read few weeks ago in an internal defect that password policy configurations are not preserved on cli after restart so just to check could you please check the current settings on CLI w/ the help of show run | in password-policy.
~BR
Jatin Katyal
**Do rate helpful posts**

Cisco ISE guests and Ironport

Hi All,
I'm currently writing a HLD for a Cisco ISE rollout in my organization, and I've come across sort-of-an-issue:
I'm planning on getting the guests in through the ISE Guest portal, but I also want to push them through an authenticated proxy(for accounting purposes) instead of a transparent one... however, I can't seem to find a way to somehow integrate Ironport and ISE in order to achieve some sort of an SSO, to avoid users having to enter their credentials twice(guest portal and ironport)- has anyone got a working solution for this?
Any constructive input appreciated!
Thanks!

Thanks for the swift responses and suggestions!
I'll most certainly have a look at the proposals...
However, I still want the guest users to go through the S370, as it's not only for accounting purposes, but I want them to authenticate, since it would make tracing and pinning events to a person way easier - that's the main reason why I'm trying to find a solution that might act like an SSO. The business side stated that signing in twice(ISE guest portal, then proxy) is unacceptable. I know that there's no direct integration between ISE and Ironport at the moment, and I am going to put in a feature request for that, but for the time being, I am really keen on getting this to work somehow...
BTW - I'm currently using a virtualised ISE, release 1.1.4., And I've got the 3395's on order...

Cisco ISE IPEP and Non Radius Authenticator

Is it possible for a Juniper FW or Aruba Wireless or anything else that does native AD authentication can use an IPEP for policy enforcement without converting the authenticator (juniper / aruba etc…) to a Radius request to a PDP for the IPEP to build the session from?
Does the IPEP simply "sniff" the packets and build a session from that or does it require RADIUS authentication to pass through for the IPEP to function?
I believe RADIUS is required but the client said he was told it is not and the authenticator can pass the traffic through the IPEP even if it authenticates clients by Native AD.
Anyone have any exmaples or traffic flows if this is possible?
Thanks,
Michael Wynston

Got my answer and it is as I thought. The iPEP only works if it sees RADIUS requests to a PDP that then provides the iPEP with the policy to enforce.
Have a client migrating from CCA which will natively check AD inline based on seen authentication requests. They were told (not by me) ISE can do that too.
Guess not
Sent from Cisco Technical Support iPhone App

Cisco ISE- Upgrade

i AM USING ise 3315 WITH 1.1.3 CAN I DIRECTLY UPDATE TO ise 1.2

ISE 1.2 is now delayed and is not shipping yet. We will let you know when it ships. SNS Appliance with 1.2 software will not be available until end of August. Until then, you must order SNS appliance with 1.1.4 and then manually upgrade it to 1.2. Existing customers with existing appliances can download 1.2 from the CCO Software Download page

Cisco ISE: HotFix and Timers for 802.1x (EAP-TLS)

Hi,
I found the below Hot-Fix to be set;
http://blogs.technet.com/b/jeff_stokes/archive/2013/01/24/20-minute-delay-deploying-windows-7-on-802-1x-fix-it-here.aspx
Kindly let me know that what is the best time to be set on it. It tells 20 mintues. Also, i wanna know that what is the corresponding configuration needs on Switch and ISE to reflect it or doesn't need it.
Thanks,
Regards,
Mubasher Sultan

Hello Mubashir,
Many timers can be modified as needed in a deployment. Unless you are experiencing a specific problem where adjusting the timer may correct unwanted behavior, it is recommended to leave all timers at their default values except for the 802.1X transmit timer (tx-period).
The tx-period timer defaults to a value of 30 seconds. Leaving this value at 30 seconds provides a default wait of 90 seconds (3 x tx-period) before a switchport will begin the next method of authentication, and begin the MAB process for non-authenticating devices.
Based on numerous deployments, the best-practice recommendation is to set the tx-period value to 10 seconds to provide the optimal time for MAB devices. Setting the value below 10 seconds may result in the port moving to MAC authentication bypass too quickly.
Configure the tx-period timer.
C3750X(config-if-range)#dot1x timeout tx-period 10

Increment Cisco ISE Base Licence

Hi guys,
I have an implementation where our client purchase two L-ISE-BSE-1K= and two L-ISE-ADV3Y-1K=. The ISE implementation is on version 1.2. I remember that on previous version if we tryed to increment the licence count with separete licences, we obtain a error uploading the licences base and advenced.
Now in version 1.2, I can see that the advanced licences are incremental, taking in mint that the endpoint count of advanced licence is not greather than the base licenced. My doubt is, If I install firts one base licence of 1K, Could I install after the other one licence of 1K and then have 2K endpoints wiht base licence? The base licence is incremental too?
Thanks for your attention on this matter.

Hi ,
License for your Part No is perpetual , for Maintenance & technical support there is separate package , kindly take support from cisco presale team .
License Type
Features Supported
Deployment Type Supported
License Prerequisite
License Term(s)
Base license
AAA
Guest provisioning
Link encryption policies
Wired
Wireless
VPN
Perpetua
Cisco Advanced Services Fixed - Price Part Number
Product Description
ASF-CORE-ISE-DSGN
Cisco ISE Design Service Package
ASF-CORE-ISE-POC
Cisco ISE Design and Proof-of-Concept Service Package
For Presales Assistance
For Cisco presales support, please consult the help desk. The help desk is open 24 hours Monday through Friday, in all countries.
● Phone: 408 902-4872
● Email: [email protected]
● Live chat: http://tinyurl.com/sacise
For More Information

Cisco ISE Base Licence: L-ISE-BSE-100=

Hi, my customer operates himself a VM for Cisco ISE, so he needs no smartnet service thats ok. Now he needs L-ISE-BSE-100= (Base Licence) 100 teers. Question: Can he gets during 5 year maintenance time updates and tecnical support for free??

Hi ,
License for your Part No is perpetual , for Maintenance & technical support there is separate package , kindly take support from cisco presale team .
License Type
Features Supported
Deployment Type Supported
License Prerequisite
License Term(s)
Base license
AAA
Guest provisioning
Link encryption policies
Wired
Wireless
VPN
Perpetua
Cisco Advanced Services Fixed - Price Part Number
Product Description
ASF-CORE-ISE-DSGN
Cisco ISE Design Service Package
ASF-CORE-ISE-POC
Cisco ISE Design and Proof-of-Concept Service Package
For Presales Assistance
For Cisco presales support, please consult the help desk. The help desk is open 24 hours Monday through Friday, in all countries.
● Phone: 408 902-4872
● Email: [email protected]
● Live chat: http://tinyurl.com/sacise
For More Information

Inline Posture between Cisco ISE and Wireless LAN Controller

Hi,
I was looking into Cisco ISE solution for deploying NAC.
I have a question about the network topology.
In the user guide documents of cisco ISE, it is written that for Wireless LAN Controllers (WLC) and VPN devices, an additional server, Inline Posture, is needed.
However, in the following integration document, there is not an inline posture between WLC and Cisco ISE server.
https://supportforums.cisco.com/docs/DOC-18121
I want to know if Inline Posture is a requirement, if not a requirement, what are the benefits of having it between Cisco ISE Server and WLC.
Thanks & Regards
Sinan

Hello,
Please go through below mentioned links which might be helpful for you.
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_ipep_deploy.html
http://www.cisco.com/en/US/docs/security/ise/1.2/installation_guide/ise_deploy.html
Best Regards,

Cisco ISE in Apple Mac Environment

Hi,
One of our clients need to implement BYOD in their network. They are using Mac servers and clients. The requirement is to authenticate (wireless) users against the Mac directory server, in order to provide access to resources. I am trying to figure out whether Cisco ISE can perform LDAP authentication with Mac server. As per this document, Mac server is not a supported external identity source/LDAP server. Currently they are providing access to users by adding MAC addresses to WLC manually, which is not practical now due to increase in number of end devices, and limitation in MAC addresses supported by WLC (2048).
Is it possible to implement this? Has anyone came across similar scenario?
Thanks,
John

The Cisco Identity Services Engine (Cisco ISE) integrates with external identity sources to validate credentials in user authentication functions, and to retrieve group information and other attributes that are associated with the user for use in authorization policies. You must configure the external identity source that contains your user information in Cisco ISE. External identity sources also include certificate information for the Cisco ISE server and certificate authentication profiles.
Both internal and external identity sources can be used as the authentication source for sponsor authentication and also for authentication of remote guest users.
Table 5-1 lists the identity sources and the protocols that they support.
Table 5-1 Protocol Versus Database Support
Protocol (Authentication Type)
Internal Database
Active Directory
LDAP1
RADIUS Token Server or RSA
EAP-GTC2 , PAP3 (plain text password)
Yes
Yes
Yes
Yes
MS-CHAP4 password hash: MSCHAPv1/v25 EAP-MSCHAPv26 LEAP7
Yes
Yes
No
No
EAP-MD58 CHAP9
Yes
No
No
No
EAP-TLS10 PEAP-TLS11 (certificate retrieval) Note For TLS authentications (EAP-TLS and PEAP-TLS), identity sources are not required, but are optional and can be added for authorization policy conditions.
No
Yes
Yes
No
1 LDAP = Lightweight Directory Access Protocol. 2 EAP-GTC = Extensible Authentication Protocol-Generic Token Card 3 PAP = Password Authentication Protocol 4 MS-CHAP = Microsoft Challenge Handshake Authentication Protocol 5 MS-CHAPv1/v2 = Microsoft Challenge Handshake Authentication Protocol Version 1/Version 2 6 EAP-MSCHAPv2 = Extensible Authentication Protocol-Microsoft Challenge Handshake Authentication Protocol Version 2 7 LEAP = Lightweight Extensible Authentication Protocol 8 EAP-MD5 = Extensible Authentication Protocol-Message Digest 5 9 CHAP = Challenge-Handshake Authentication Protocol 10 EAP-TLS = Extensible Authentication Protocol-Transport Layer Security 11 PEAP-TLS = Protected Extensible Authentication Protocol-Transport Layer Security
and for the WLC Check the Link : www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/91901-mac-filters-wlcs-config.html#backinfo

Cisco ISE Deployment suggestion required

Require Assistance on Cisco ISE Deployment for below scenario
-- We have Three Cisco ISE Appliances and Client has taken Advance Subscription License for 500 users
-- Client has DC & DR and needs to deploy the Cisco ISE in one Main Office which connects to DC & DR on MPLS Links
-- Client suggestion was to deploy one ISE node ( Admin + M&T + Policy Server ) in DC and its Standby Secondary in DR
     and only deploy Policy Server in Main Office.
     Idea behind the design is that ,
     1) If DC fails , Cisco ISE related logs will get generated on DR and any Cisco ISE related request will be taken care by Local Policy Server in Main Office .
      2) If Local Policy Server Fails , then ISE node in DC will act as Secondary backup and DR will act Teritary Backup
      below is view
                                     DC
                        Primary Node with Role
                   [Admin , M&T , Policy Server]
                                                                                                             Main Remote Offic
                                                                                                              Cisco ISE Node ( Only Policy Server) -----------> Network Devices
                               DR
                       Secondary   Node with Role
                   [Admin , M&T , Policy Server]
Please let me know is it possible

Yes, The scenario is quite achievable also please review the below link for assistance on deployment of ISE.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_50_ise_deployment_tg.pdf
http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.pdf

Cisco ISE auth policy based on Active Directory domain membership

I am currently testing the Cisco ISE product and I am trying to find a way to assign an authorization policy based on domain membership. Our company sorts standard users and project team member into different domains so it seemed like the ideal thing to sort with. Unfortunately, I am no AD expert and there are a mind boggling number of conditions/expressions to choose from. I figured I would be the first person to try this. What have other done to solve this problem?
I have tried using the memberOf attribute and matching to .*(domain).* Basically looking to see if memberOf contains the domain name. It works for machine authentication, but when I log it the system cannot find my account info for some reason and boots me to the guest vlan.
Thank you.

Are the two sets of users actually residing on two separate and independent domains? If so then that is probably where your problem is as ISE can only integrate with a single domain. If you have multiple domains then there must be a trust relationship between them. Another solution is to use LDAP integrations as there is not a limit with LDAP integrations.
Thank you for rating!

Cisco ise upgrading and licences

Similar Messages

Maybe you are looking for