Cisco ISE MAC Move and host movement

Hello,
I read that SNMPTraps should not be sent to ISE when using the RADIUS probe, because it will only trigger a duplicate SNMPQuery. If so, how do you support a use case whereby a device can successfully deauthorize from a switch port and authorize on another port. Is it the one of the following in exclusion of others?
1. authentication mac-move permit
2. IP device tracking
3. mac address-table notification change, mac address-table notification mac-move, snmp-server trap (global config) and snmp trap mac-notification (interface config)
I understand that for a device behind a non-cisco IP phone, CDP or LLDP or EAPOL Proxy logoff will inform the switch.
Thanks

Hi,
Thanks for responding. However, my question was not about MAB or dot1x behind a phone. I had already mentioned about EAPOL proxy logoff.
What I really wanted to know was about a dot1x device authorised on a switch port and then moved to another port. Do you have to add the global command authentication mac-move permit to support this or IP device tracking is enough, so that there is no port security violation.
Thanks

Similar Messages

My mac crashed and the movies I had downloaded dissapeared... what do I do to recover them or get a refund?

My mac crashed and the movies I had downloaded dissapeared... what do I do to recover them or get a refund?
I already restarted the computer... and the movies are not available on iTunes anymore.
Very disapointing...
GasparG

You don't redownload them or get a refund.
You buy one download only. It is your responsibility to backup your purchase.

I want to integrate SMS gateway to Cisco ISE 1.2 and my question is SMS notifications are supported for Guest self−registration

I want to integrate SMS gateway to Cisco ISE 1.2 and my question is
SMS notifications are supported for Guest self−registration Services ? or it should be done by Sponsor

I'm not sure I understand the question. Do you want to log in to the Sponsor Portal using AD credentials?
Create an Identity Source Sequence using AD as an Authentication Source. Go to Administration > Identity Management > Identity Source Sequences. Either Edit or +Add a Sequence and choose from the Authentication Sources shown.
Then choose that Identity Source Sequence by going to Administration > Web Portal Management > Settings. Double-click Sponsor from the Left Menu and click Authentication Source. Choose the Identity Source Sequence. Click Save.
I hope this helps.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Is Which one is safer MacX DVD Ripper Pro or Handbrake to rip personal DVD movie and other movies on iMac Yosemite?

Is Which one is safer MacX DVD Ripper Pro or Handbrake to rip personal DVD movie and other movies on iMac Yosemite?

You've already asked this question. Please confine your responses to the original topic so answers aren't getting spread out.

Scanner moves and then moves back to start and turns my printer off.

When turning on my printer, the scanner moves and then moves back to start and turns my printer off. I can not turn my printer back on unless I unplug it and plug it back in. Then it just does the same thing again and again and again.

Hello @LuvInCayer , and welcome to the HP Forums!
I see you're having power issues. I would like to help!
I'd recommend starting with a power reset. Disconnect the power cord from the printer and the power outlet, then wait 60 seconds. After 60 seconds, plug the printer back in. Ensure you plug the printer directly to a wall outlet. Make sure to bypass any sort of surge protector or power bar.
I would also recommend plugging the printer power into a different wall outlet.
Good luck and please let me know the results of your troubleshooting steps. Thank you for posting on the HP Forums!
Please click “Accept as Solution " if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the right to say “Thanks" for helping!
Jamieson
I work on behalf of HP
"Remember, I'm pulling for you, we're all in this together!" - Red Green.

Mac min and i movie

When i launch i movie it says my mac mini does not contain an quartz extreme compatible graphics card & quartz extreme is not working in i movie. Any suggestions of the source of the problem and how to fix would be appeciated..thanks..

Its nice that this problem was solved, but it would be even nicer if we knew what solved it.
I am looking at either a Mac Mini (2g/2g) or the iMac 2.4g/24", and have been perusing the Mini forums for info on how well the Mini runs iMovie, or even FCE. I have used FCP 3.0 for years on my G4 / 900 m, but don't need the power of FCP (or the hefty upgrade price).
I took a look at iMovie 06 an iDVD 06, and find they will pretty much suit my current needs. I am mostly just moving (and editing) old VHS home video to DVD. However, iMovie bogged down quite a bit on my tired old G4 after some extensive editing that required lots of sound track work. While this isn't normal in the simple VHS-DV conversion process, I figure I might as well get a newer, faster, system to allow for it.
Many comments on the Mini address "great for everything but 3D graphics gaming" This is perfectly fine, but I noted a warning about "quartz extreme" regarding FCE, so am interested in the same problem with iMovie.
The real question I am asking, tho, is whether iMovie or FCE editing is as the upper edge of chanllenge for the Mac Mini, and I should go for the iMac, or is the editing just a middle-of-the-road challenge for the Mac Mini.
I am intrigued with saving hte $1000 on the iMac by reusing my Monitor, Keyboard and Mouse, bu tnot at the risk of finding that the Mac Mini only "almost" does the job.
Thanks

Cisco ISE 1.1 and IE9

Is anyone else having problems with ISE admin/monitoring pages not working properly under IE9? I just completed an upgrade to ISE 1.1, and it seems more and more, when I try to manage the system with IE9, I will get the following error (host name changed to protect the inocent). I dont know if this is truly an IE9 issue, or the chrome plug-in we are forced to use. Works perfect under Firefox 11.0.
This webpage is not available
The webpage at https://iseserver.domain.com/mnt/pages/dashboard/dashboard.jsp?mnt_config_write=true&token=BEGIN_TOKENXspmm4x5AwFsV6NExIBAVA==END_TOKEN might be temporarily down or it may have moved permanently to a new web address.
Error 103 (net::ERR_CONNECTION_ABORTED): Unknown error.

Supported Administrative User Interface Browsers
You can access the Cisco ISE administrative user interface using the following browsers:
•Mozilla Firefox 3.6 (applicable for Windows, Mac OS X, and Linux-based operating systems)
•Mozilla FireFox 9 (applicable for Windows, Mac OS X, and Linux-based operating systems)
•Windows Internet Explorer 8
•Windows Internet Explorer 9 (in Internet Explorer 8 compatibility mode)
Cisco ISE GUI is not supported on Internet Explorer version 8 running in Internet Explorer 7 compatibility mode. For a collection of known issues regarding Windows Internet Explorer 8, see the "Known Issues" section of the Release Notes for the Cisco Identity Services Engine, Release 1.1.

Cisco ISE 1.2 and Cisco ACS 5.4 patch 6 and support for snmp version 3

does anyone know if cisco ISE version 1.2 patch 8 and Cisco ACS 5.4 patch 6 support snmp version 3?
ciscoISE/admin(config)# snmp-server ?
community Set community string
contact    Text for mib object sysContact
host       Specify hosts to receive SNMP notifications
location   Text for mib object sysLocation
ciscoISE/admin(config)# snmp-server
Ciscoacs/admin(config)# snmp-server ?
community Set community string
contact    Text for mib object sysContact
host       Specify hosts to receive SNMP notifications
location   Text for mib object sysLocation
Ciscoacs/admin(config)# snmp-server

No support SNMP v3 on ISE v1.2 and 1.3 except for profilling
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/cli_ref_guide/ise_cli/ise_cli_app_a.html#12768
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/cli_ref_guide/b_ise_CLIReferenceGuide/b_ise_CLIReferenceGuide_chapter_0100.html#ID-1364-00000d30

Cisco ISE 1.2 and AD Group

Hello,
I have Cisco ISE installed on my EXSi server for my test pilot. I have added several AD groups to ISE as well.
I have created an Authorization policy condition, which is WIRELESS_DOT1X_USERS (see screenshot)
Basically, I just duplicated the default Wireless_802.1X and added Network Access:EapAuthentication, Equals, EAP-TLS.
My problem is, I was unable to join the wireless network if I added my AD group to the Authorization policy (see screenshot). The user that I have is a member of WLAN-USERS. If I removed the AD group from the Authorization policy, the use is able to join the wireless network.
I attached the ISE logs screenshot as well. I checked the ISE, AD/NPS, WLC, laptop time and date, and they are all in synched.
I also have the WLC added as NPS client on my network.
I checked the AD log and what I found was the WLCs local management user trying to authenticate. It is supposed to be my wireless user credential not the WLC.
This is the log that I got from the AD/NPS
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:                              NULL SID
Account Name:                              admin
Account Domain:                              AAENG
Fully Qualified Account Name:          AAENG\admin
Client Machine:
Security ID:                              NULL SID
Account Name:                              -
Fully Qualified Account Name:          -
OS-Version:                              -
Called Station Identifier:                    -
Calling Station Identifier:                    -
NAS:
NAS IPv4 Address:                    172.28.255.42
NAS IPv6 Address:                    -
NAS Identifier:                              RK3W5508-01
NAS Port-Type:                              -
NAS Port:                              -
RADIUS Client:
Client Friendly Name:                    RK3W5508-01
Client IP Address:                              172.28.255.42
Authentication Details:
Connection Request Policy Name:          Use Windows authentication for all users
Network Policy Name:                    -
Authentication Provider:                    Windows
Authentication Server:                    WIN-RSTMIMB7F45.aaeng.local
Authentication Type:                    PAP
EAP Type:                              -
Account Session Identifier:                    -
Logging Results:                              Accounting information was written to the local log file.
Reason Code:                              16
Reason:                                        Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect.

Thank you Tarik,
I got my AD group working. What I did, I checked the user's certificate that is installed on the laptop then modified the ISE certificate authentication profile to "Subject Alternative Name". I had the ISE set to common name when I was having an issue.
I forgot to mentioned that I have to servers in my ISE test pilot. I have AD with NPS, and CA. These servers are Windows 2008 R2.
I am a little confuse about the attribute in certificate template you have mentioned. Is that located at Certificate Authority/server-name/Certificate Templates/Users? I am not sure where to look for that attribute on the CA server.

Cisco ISE posture assesment and client provisioning

Hello,
I have Cisco ISE and Cisco IOS device. I have configured RADIUS in between these device.
Also I have configured RADIUSbetween Cisco ISE and Cisco ASA. Now I want to know that how to do posture assesment for these devices(Cisco ISE and Cisco ASA or Cisco ISE and Cisco IOS). Please give me whole steps to do posture assesment for cisco ios device in Cisco ise.
Also, please provide me logs related to posture assesment and client provisioning.
Thanks in advance.

You may go through the below listed link to download a PDF link
Posture assessment with ISE.
http://www.cisco.com/web/CZ/expo2012/pdf/T_SECA4_ISE_Posture_Gorgy_Acs.pdf
~BR
Jatin Katyal
**Do rate helpful posts**

Cisco ISE with TACACS+ and RADIUS both?

Hello,
I am initiating wired authentication on an existing network using Cisco ISE. I have been studying the requirements for this. I know I have to turn on RADIUS on the Cisco switches on the network. The switches on the network are already programmed for TACACS+. Does anybody know if they can both operate on the same network at the same time?
Bob

Hello Robert,
I believe NO, they both won't work together as both TACACS and Radius are different technologies.
It's just because that TACACS encrypts the whole message and Radius just the password, so I believe it won't work.
For your reference, I am sharing the link for the difference between TACACS and Radius.
http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml
Moreover, Please review the information as well.
Compare TACACS+ and RADIUS
These sections compare several features of TACACS+ and RADIUS.
UDP and TCP
RADIUS uses UDP while TACACS+ uses TCP. TCP offers several advantages over UDP. TCP offers a connection-oriented transport, while UDP offers best-effort delivery. RADIUS requires additional programmable variables such as re-transmit attempts and time-outs to compensate for best-effort transport, but it lacks the level of built-in support that a
TCP transport offers:
TCP usage provides a separate acknowledgment that a request has been received, within (approximately) a network round-trip time (RTT), regardless of how loaded and slow the backend authentication mechanism (a TCP acknowledgment) might be.
TCP provides immediate indication of a crashed, or not running, server by a reset (RST). You can determine when a server crashes and returns to service if you use long-lived TCP connections. UDP cannot tell the difference between a server that is down, a slow server, and a non-existent server.
Using TCP keepalives, server crashes can be detected out-of-band with actual requests. Connections to multiple servers can be maintained simultaneously, and you only need to send messages to the ones that are known to be up and running.
TCP is more scalable and adapts to growing, as well as congested, networks.
Packet Encryption
RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party.
TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. For debugging purposes, it is useful to have the body of the packets unencrypted. However, during normal operation, the body of the packet is fully encrypted for more secure communications.
Authentication and Authorization
RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization.
TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After a NAS authenticates on a Kerberos server, it requests authorization information from a TACACS+ server without having to re-authenticate. The NAS informs the TACACS+ server that it has successfully authenticated on a Kerberos server, and the server then provides authorization information.
During a session, if additional authorization checking is needed, the access server checks with a TACACS+ server to determine if the user is granted permission to use a particular command. This provides greater control over the commands that can be executed on the access server while decoupling from the authentication mechanism.
Multiprotocol Support
RADIUS does not support these protocols:
AppleTalk Remote Access (ARA) protocol
NetBIOS Frame Protocol Control protocol
Novell Asynchronous Services Interface (NASI)
X.25 PAD connection
TACACS+ offers multiprotocol support.
Router Management
RADIUS does not allow users to control which commands can be executed on a router and which cannot. Therefore, RADIUS is not as useful for router management or as flexible for terminal services.
TACACS+ provides two methods to control the authorization of router commands on a per-user or per-group basis. The first method is to assign privilege levels to commands and have the router verify with the TACACS+ server whether or not the user is authorized at the specified privilege level. The second method is to explicitly specify in the TACACS+ server, on a per-user or per-group basis, the commands that are allowed.
Interoperability
Due to various interpretations of the RADIUS Request for Comments (RFCs), compliance with the RADIUS RFCs does not guarantee interoperability. Even though several vendors implement RADIUS clients, this does not mean they are interoperable. Cisco implements most RADIUS attributes and consistently adds more. If customers use only the standard RADIUS attributes in their servers, they can interoperate between several vendors as long as these vendors implement the same attributes. However, many vendors implement extensions that are proprietary attributes. If a customer uses one of these vendor-specific extended attributes, interoperability is not possible.
Traffic
Due to the previously cited differences between TACACS+ and RADIUS, the amount of traffic generated between the client and server differs. These examples illustrate the traffic between the client and server for TACACS+ and RADIUS when used for router management with authentication, exec authorization, command authorization (which RADIUS cannot do), exec accounting, and command accounting (which RADIUS cannot do).

Cisco ISE: Dot1x failing and MAB succeeded (Intermittent) /or Posture Delay

Hi,
We are running the cisco ise 1.1.3 and configured for the Dot1x and MAB authentications. PC's are getting access through MAB while Dot1x failing again and again. But, sometime, same PC is getting authenticating via Dot1x. Connectivity is intermittent. Also, sometimes, stucks longer in Posture
We have three different switches at the moment with the latest IOS version.
1) WS-C4507R-E = 15.1(2)SG,
2) WS-C3560-48PS = 12.2(55)SE7
3) WS-C3750X-24P = 15.0(2)SE1
Could you anyone pitch the idea? or advise about the latest IOS for the switches.
Let me know, if you need more information.
Thanks,
Regards,
Mubahser

It seems your PCs are failing dot1x and also failing MAB authentication, the switch by default will start the process again and will again fail dot1x and MAB authentication, and so on.
It will be helpful to see the logs from both the switch and the radius servers (i take it is ACS or ISE). Also the configuration of the radius server.

Upgrade to 10.8 cannot play movies and no movies in Photo Booth

Hi
I have been upgrading my iMac and now i cannot play .mov and there are no movies in photo booth.
Is there something I need to do to get this back?
Thanks

In the iTunes preferences have you tried the option under the Advanced tab to Change the location of your iTunes Media Folder location?
This might point you in the right direction
http://support.apple.com/kb/HT1449?viewlocale=en_US&locale=en_US
So on your external drive is all of your media in a folder called itunes or is it just music, movies etc. just in a bunch of folders that iTunes is not organizing?

What's a safe DVD ripper to make copy of personal DVD movie and other movies?

What's a safe DVD ripper to make copy of personal DVD movie and then make a copy to another blank DVD?

The easiest way is to use Disk Utility to create a disk image of the DVD; you can then burn that to a blank DVD (and indeed play it using the DVD player).
Insert your DVD. Open Disk Utility and select it in the sidebar (the disk itself, not the drive it's in.) Click 'New Image' in the toolbar.
In the dialog box which opens set 'Image Format' to 'DVD/CD Master' and 'Encryption' to 'none'. This will make an exact copy without re-compressing.
Obviously this will not work on a commercially issued DVD, only on ones you make yourself or which are not DRM protected.

HT1657 rent a movie and the movie is gone

I rented the same movie and twice and one more and i doenst show up in itunes. Now I´m affraid that I´m gonna pay doubles for the first one and pay for the last one. But still, I don´t have the movies? Where do they go and where can i get my money back? Thanks

No

Cisco ISE MAC Move and host movement

Similar Messages

Maybe you are looking for