Cisco ISE NAM Distribution/Deploy GPO AD

Any AD users out there, i am trying to deploy NAM using GPO or some sort?
I need help with MSI, instllation GPO or point me in to right direction.
thank you

Please see the link below the information is there for your query.
http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_guest_pol.html#wp1096365

Similar Messages

Inline Posture between Cisco ISE and Wireless LAN Controller

Hi,
I was looking into Cisco ISE solution for deploying NAC.
I have a question about the network topology.
In the user guide documents of cisco ISE, it is written that for Wireless LAN Controllers (WLC) and VPN devices, an additional server, Inline Posture, is needed.
However, in the following integration document, there is not an inline posture between WLC and Cisco ISE server.
https://supportforums.cisco.com/docs/DOC-18121
I want to know if Inline Posture is a requirement, if not a requirement, what are the benefits of having it between Cisco ISE Server and WLC.
Thanks & Regards
Sinan

Hello,
Please go through below mentioned links which might be helpful for you.
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_ipep_deploy.html
http://www.cisco.com/en/US/docs/security/ise/1.2/installation_guide/ise_deploy.html
Best Regards,

How to deploy Cisco ISE agents through SCCM 2012 R2

Hi,
We are deploying Cisco ISE in our setup. we need to deploy following 3 .msi & 1 .xml files to 3000 PCs through System Center 2012 R2 Configuration Manager.
The configuration.xml file must be deployed in specified (%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\NetworkAccessManager\newConfigFiles) location.
anyconnect-nam-win-4.0.02052-k9.msi
anyconnect-win-4.0.02052-pre-deploy-k9.msi
nacagentsetup-win-4.9.0.42.msi
configuration.xml
The above 3 .msi files should be installed silently and configuration.xml file to be copied to said location.
I want to create one package to deploy 3.msi files at once and another package for .xml file.
or
Is there anyway to create in one package to install the .msi files first and copy the .xml file as well.
Any idea please.
Regards,Ali

Hi,
Have you tried to create a script.
You can easily test this by running your script manually with psexec -s
to emulate running as SYSTEM account.
Reference:
Robocopy
https://technet.microsoft.com/en-us/library/cc733145.aspx
Windows Installer : MSIEXEC Silent Install End to END
http://sccm2o12.blogspot.com/2010/04/windows-installer-msiexec-silent.html
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Cisco ISE change Domain Name

Our ISE deployment was setup with our internal domain name of csi.corp, when presenting the guest CWA this is the domain name the is presented to
the guest. We would like for this to be out public domain and a valid certificate. From what I have gathered the web portal https certificate must contain the FQDN of the ISE node, therefore I would need to change the domain name on the server(s). I have found posts that some have changed the domain name after deployment without any adverse results, is this possible? We are currently integrated with our corp AD and able to utilize this the EAP authentications. We have 2 nodes in our deployment, is it possible to change the domain name to our public domain without a rebuild?
Thanks,
Joe

Hmm, unless something has changed I don't believe this would work because:
- Even though the CN doesn't have to be an exact match of the FQDN, I believe that the domain suffix in the CN still must match the domain suffix in the FQDN. So you can have many different values and domains in the SAN fields but the domain in the CN field must match the domain specified in the FQDN. I don't have any certs to test this with now but I am pretty sure that even though the CSR generation would work, the process will fail when trying to import the cert.
- Is ".local.corp" a public domain? It doesn't sound like it but perhaps it is :) However, if it is not, then many public CAs won't issue you a public certificate for a private domain. You can definitely give it a try and see what they say :)
Let me know what you find out!
Thank you for rating helpful posts!

Manually Patch Cisco ISE Deployment

Is there a documented process for manually installing patch bundles in ISE? We had a bad experience last spring with deploying Patch 8 through the "fire and forget" patch installation through the GUI. We have held off far too long on patching our 20 node deployment and I will be asked whether the process failure was due to Patch 8, or whether the patching process itself failed. Please let me know if there is a procedure on how one would go about manually patching a deployment via the CLI.
Thank you

install a patch from a primary administration node that is part of a distributed deployment, Cisco ISE installs the patch on the primary node and then all the secondary nodes in the deployment. If the patch installation is successful on the primary node, Cisco ISE then continues patch installation on the secondary nodes. If it fails on the primary node, the installation does not proceed to the secondary nodes. However, if the installation fails on any of the secondary nodes for any reason, it still continues with the next secondary node in your deployment. Secondary Cisco ISE nodes are restarted consecutively after the patch is installed on those nodes. While installing a patch on secondary nodes, you can continue to perform tasks on the primary administration node.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/cli_ref_guide/ise_cli/ise_cli_app_a.html#pgfId-2476373

Cisco ISE Deployment suggestion required

Require Assistance on Cisco ISE Deployment for below scenario
-- We have Three Cisco ISE Appliances and Client has taken Advance Subscription License for 500 users
-- Client has DC & DR and needs to deploy the Cisco ISE in one Main Office which connects to DC & DR on MPLS Links
-- Client suggestion was to deploy one ISE node ( Admin + M&T + Policy Server ) in DC and its Standby Secondary in DR
     and only deploy Policy Server in Main Office.
     Idea behind the design is that ,
     1) If DC fails , Cisco ISE related logs will get generated on DR and any Cisco ISE related request will be taken care by Local Policy Server in Main Office .
      2) If Local Policy Server Fails , then ISE node in DC will act as Secondary backup and DR will act Teritary Backup
      below is view
                                     DC
                        Primary Node with Role
                   [Admin , M&T , Policy Server]
                                                                                                             Main Remote Offic
                                                                                                              Cisco ISE Node ( Only Policy Server) -----------> Network Devices
                               DR
                       Secondary   Node with Role
                   [Admin , M&T , Policy Server]
Please let me know is it possible

Yes, The scenario is quite achievable also please review the below link for assistance on deployment of ISE.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_50_ise_deployment_tg.pdf
http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.pdf

Cisco ISE deployment with HP Swithes

Is there any compatibility matrix of cisco ISE with HP access swithes or there is any features restriction on HP access layer. The HP switches do support 802.1x.
Thanks
Qasim

Qasim,
The only compatibility with network access devices is all related to Cisco gear. It would be best to stick with a full supported solution for the sake of support. In my opinion this will be a nightmare to manage if an issue was to occur.
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco ISE Guest Portal - DNS Issue - External Zone

Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

Cisco ISE AD (Windows Server 2013) Authentication Problem

Background:
Deployed two Cisco ISE 1.1.3. ISE will be used to authenticate wireless users, admin access to WLC and switches. Backend database is Microsoft AD running on Windows Server 2012. Existing Cisco ACS 4.2 still running and authenticating users. There are two Cisco WLCs version 7.2.111.3.
Wireless users authenticates to AD through ACS 4.2 works. Admin access to WLC and switches to AD through ISE works. Wireless authentication using PEAP-MSCHAPv2 and admin access wtih PAP/ASCII.
Problem:
Wireless users cannot authenticate to AD through ISE. The below is the error message "11051 RADIUS packet contains invalid state attribute" & "24444 Active Directory operation has failed because of an unspecified error in the ISE".
Conducted a detailed test of AD from ISE. The test was successful and the output seems all right except for the below:
xxdc01.xx.com (10.21.3.1)
Pinged:0 Mins Ago
State:down
xxdc02.xx.com (10.21.3.2)
Pinged:0 Mins Ago
State:down
xxdc01.xx.com
Last Success:Thu Jan 1 10:00:00 1970
Last Failure:Mon Mar 11 11:18:04 2013
Successes:0
Failures:11006
xxdc02.xx.com
Last Success:Mon Mar 11 09:43:31 2013
Last Failure:Mon Mar 11 11:18:04 2013
Successes:25
Failures:11006
Domain Controller: xxdc02.xx.com:389
    Domain Controller Type: Unknown DC Functional Level: 5
    Domain Name:            xx.COM
    IsGlobalCatalogReady:   TRUE
    DomainFunctionality:           2 = (DS_BEHAVIOR_WIN2003)
    ForestFunctionality:           2 = (DS_BEHAVIOR_WIN2003)
Action Taken:
Log on to Cisco ISE and WLC using AD credentials. This rules out AD connection, clock and AAA shared secret as the problem.
2)     Tested wireless authentication using EAP-FAST but same problem occurs.
3)     Detailed error message shows the below. This rules out any authentication and authorization polices. Before even hitting the authentication policy, the AD lookup fails.
12304 Extracted EAP-Response containing PEAP challenge-response
11808 Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - AD1
24430 Authenticating user against Active Directory
24444 Active Directory operation has failed because of an unspecified error in the ISE
4)     Enabled AD debugging logging and had a look at the logging. Nothing significant and no clues to the problem.
5)     Tested wireless on different laptos and mobile phones with same error
6)     Delete and add again AAA Client/Devices on both Cisco ISE and WLC
7)     Restarted ISE services
8)     Rejoin domain on Cisco ISE
9)     Checked release notes of ISE 1.1.3 and WLC 7.2.111.3 for any open caveats. Nothing found related to this problem.
10)    There are two ISE and two WLC deployed. Tested different combination of ISE1 to WLC1, ISE1 to WLC2 etc. This rules out hardware issue of WLC.
Other possibilities/action:
1)     Test it out on a different WLC version. Will have to wait outage approval to upgrade WLC software.
2)     Incompatibility of Cisco ISE and AD running on Microsoft Windows Server 2012
Anyone out there experienced something similar of have any ideas on why this is happening?
Thanks.
Update:
1) Built another Cisco ISE 1.1.3 sever in another datacentre that uses the same domain but different domain controller. Thais domain controller is running Windows Server 2008. This works and authentication successful.
2) My colleague tested out in a lab environment of Cisco ISE 1.1.2 with Windows Server 2012. He got the same problem as described.
This leads me to think there is a compatibility issue of Cisco ISE with Windows Server 2012.

Does anyone know if ISE 1.1.3 p1 supports AD DCs running 2012, if not which patch is required ot version?
Worryingly when ISE joins a 2012 DC it states it's connected successfully, and if another 2003 DC is available in that datacentre it will perform the auths against that DC whilst actually advertising (Connections in the GUI) that it's connected to the 2012 DC. We ended up mapping 8 PSN IP’s to another datacentre which has one Win2003 servers whilst the old 2003 DC is being promoted back, the 8 ISE servers started working, even though they still advertised they were connected to the 2012 DCs in the original datacentre - I performed a leave and join on one PSN and only then did it advertise that the node was connected to a DC in a different datacentre

Cisco ISE functionally and license

HI.
I wanna configure the following on Cisco ISE 1.2.1.
Self-registration portal for guests (SSID: guests)
802.1x user certificate check (Cisco NAM supplicant) for employees (SSID: Corporate) (EAP-TLS)
Self provisioning portal (to deploy BYOD certificate and give access for BYOD devices) for BYOD devices (SSID: Corporate) (PEAP, MSHAPv2)
Can I configure these things with PLUS license or do I need Adv or Wireless? I am not sure if one of these requires profiling functionally.

With plus license all the above items should work.
Here is what plus license supports:
Bring Your Own Device (BYOD)
Profiling
Endpoint Protection Service (EPS)
TrustSec SGT
For more info, refer ISE license section:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_license.html#41012
Regards,
Jatin Katyal
**Do rate helpful posts**

Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.

Hi to all,
I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID. The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
Error: Resource not found.
Resource: /guestportal/
Does anyone have any ideas why the portal is doing this?
Thanks
Paul

Hello,
As you are not able to get the guest portal, then you need to assure the following things:-
1) Ensure that the two Cisco av-pairs that are configured on the authorization profile should exactly match the example below. (Note: Do not replace the "IP" with the actual Cisco ISE IP address.)
–url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
–url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also defined on the access switch)
2) Ensure that the URL redirection portion of the ACL have been applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address that is passed to the client machine by the DHCP server.)
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
0000A45A2444BFC2&action=cpp
3) Ensure that the preposture assessment DACL that is enforced from the Cisco ISE authorization profile contains the following command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
permit tcp any host 80.0.80.2 eq www --> Provides access to internet
permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
port
permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
deny ip any any
Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on the switch as follows:
ip access-list extended ACL-WEBAUTH-REDIRECT
deny ip any host 80.0.80.2
permit ip any any
5) Ensure that the http and https servers are running on the switch:
ip http server
ip http secure-server
6) Ensure that, if the client machine employs any kind of personal firewall, it is disabled.
7) Ensure that the client machine browser is not configured to use any proxies.
8) Verify connectivity between the client machine and the Cisco ISE IP address.
9) If Cisco ISE is deployed in a distributed environment, make sure that the client machines are aware of the Policy Service ISE node FQDN.
10) Ensure that the Cisco ISE FQDN is resolved and reachable from the client machine.
11) Or you need to do re-image again.

Cisco ISE some Radius issues

Dear guys,
     I deployed Cisco ISE for Network Access Control. My topology as described as attached image. I configured Cisco ISE as Radius Server for Client Access Control. But, I got some problems such as:
No Accounting Start. (I have configured accouting on Switch 2960).
Radius Request Dropped (attached image). These NAS IP Address are Servers on same subnet with Cisco ISE.
I would greatly appreciate any help you can give me in working this problem.
Have a nice day,
Thanks and Regrads,

Sorry for late reply.
Here is my switch config.
Current configuration : 8630 bytes
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname Switch
boot-start-marker
boot-end-marker
no logging console
enable password ******************
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting delay-start all
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
aaa accounting network default start-stop group radius
aaa server radius dynamic-author
client A.B.C.D server-key keystrings
aaa session-id common
system mtu routing 1500
vtp mode transparent
ip dhcp snooping
ip device tracking
crypto pki trustpoint TP-self-signed-447922560
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-447922560
revocation-check none
rsakeypair TP-self-signed-447922560
crypto pki certificate chain TP-self-signed-447922560
certificate self-signed 01
xxxxx
dot1x system-auth-control
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
vlan 139,153,401-402,999,1501-1502
interface FastEthernet0/11
switchport access vlan 139
switchport mode access
authentication host-mode multi-auth
authentication open
authentication port-control auto
authentication periodic
authentication timer inactivity 180
authentication violation restrict
mab
interface FastEthernet0/12
switchport access vlan 139
switchport mode access
ip access-group ACL-ALLOW in
authentication event fail action next-method
authentication event server dead action authorize vlan 139
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity 180
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
interface GigabitEthernet0/1
switchport mode trunk
interface GigabitEthernet0/2
interface Vlan1
no ip address
interface Vlan139
ip address E.F.G.H 255.255.255.0
ip default-gateway I.J.K.L
ip http server
ip http secure-server
ip access-list extended ACL-ALLOW
permit ip any any
ip access-list extended ACL-DEFAULT
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
permit icmp any any
permit tcp any host A.B.C.D eq 8443
permit tcp any host A.B.C.D eq 443
permit tcp any host A.B.C.D eq www
permit tcp any host A.B.C.D eq 8905
permit tcp any host A.B.C.D eq 8909
permit udp any host A.B.C.D eq 8905
permit udp any host A.B.C.D eq 8909
deny   ip any any
ip access-list extended ACL-WEBAUTH-REDIRECT
permit tcp any any eq www
permit tcp any any eq 443
deny   ip any any
ip radius source-interface Vlan139
snmp-server community keystrings RW
snmp-server enable traps snmp linkdown linkup
snmp-server enable traps mac-notification change move
snmp-server host A.B.C.D version 2c keystrings mac-notification
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 5 tries 3
radius-server host A.B.C.D auth-port 1812 acct-port 1813 key STRINGSKEY
radius-server vsa send accounting
radius-server vsa send authentication
line con 0
line vty 5 15
end
My switch version is
WS-2960 12.2(55)SE5 C2960-LANBASEK9-M
I would greatly appreciate any help you can give me in working this problem.

Cisco ISE with Flex Connect ios 7.4

Hello my name is Ivan
I have a question:
Is possible to do a deployment with cisco ise (trust sec 2.0) and flex connect and web authentication to a cluster of cisco wlc (ios 7.4)?
There are a features or requeriments to configure this?
Regards
Ivan

By "cluster of cisco wlc" are you referring to the HA features for the 5508? HA or not should be irrelevant to the configuration of ISE w/ 7.4 WLC on flex connect.
Configuring CWA (central web auth) via L2/Mac-Filter and RADIUS NAC will require that you have a FlexConnect group built with the desired AP within the group. You will need to build FlexConnect ACLs and apply them to the FlexConnect group that correspond with the various NAC states the client will be in during the CWA process.
You will probably need 1 or 2 Web Policy ACLs
1. allow traffic to/from dns and ISE PSN
2. allow traffic to/from dns, ise and other resources (for instance for posturing/remediation)
Please note that you cannot "dynamically" assign ACLs to FlexConnect APs/Groups as part of the transition from central webauth reqd to RUN. The WebPolicies ACLs are the only ones that can override (think of them like pre-auth acls). Once you finally send back the access-accept for the client you can not apply dynamic acls to the particular wlan/vlan.
For instance if you needed differentiated access on a single network between guest and vendors, you couldn't send an access-accept back with an ACL for vendors vs an ACL for guests - in a FlexConnect environment. They would have to be placed on separate networks with their respective access.
It's possible this type of configuration (much desired) will be allowed in 7.5 whenever it rears its head.

Cisco ISE: 802.1x [EAP-TLS] + List of Applicable Hot-Fixes

Dear Folks,
Kindly suggest the list of all possible Hot-Fixes required for the Cisco ISE EAP-TLS solution... We have applied 9 HotFixes so far. But, still the connectivity is intermittent. Is there any list for all applicable Hot-Fixes?
OS = Win 7 SP1 (32/64 Bit) and Win 8
Thanks,
Regards,
Mubasher Sultan

Hi Mubasher
KB2481614:      If you’re configuring your 802.1x settings via Group Policy you’ll see      sometimes EAP-PEAP request from clients in your radius server log during      booting even if you’ll set EAP-TLS. This error happened in our case with      1/3 of the boots with some models. The error is caused by a timing problem      during startup. Sometimes the 802.1x is faster and sometimes the Group      Policy is, and if the 802.1x is faster than the default configuration is      taken, which is PEAP. Which lead to a EAP-NAK by the radius server.
KB980295:      If an initial 802.1x authentication is passed, but a re-authentication      fails, Windows 7 will ignore all later 802.1x requests. This hotfix should      also fix a problem with computers waking up from sleep or hibernation –      but we’ve disabled these features so I can’t comment on them.
KB976373:      This hotfix is called “A computer that is connected to an IEEE      802.1x-authenticated network via another 802.1x enabled device does not      connect to the correct network”. I can’t comment on this, as we’ve not      deployed 802.1x for our VoIP phones at this point.I would guess it is the      same for Windows 7 too. The linked article tells you to install the patch      and set some registry key to lower the value.
KB2769121:      A short time ago I found this one: “802.1X authentication fails on a      Windows 7-based or Windows 2008 R2-based computer that has multiple      certificates”. At time of writing I’m not sure if it helps for something      in my setup. According to the symptoms list of the hotfix, it does not,      but maybe it helps for something else, as the one before does.
KB2736878:      An other error during booting – this time it happens if the read process      starts before the network adapter is initialized. Really seems that they      wanted to get faster boot times, no matter the costs.
KB2494172:      This hotfix fixes a problem if you’ve installed a valid and invalid      certificate for 802.1x authentication. The workaround is just deleting the      invalid certificate. I’m not sure at this point if it affects also wired      authentication.
KB976210:This      problem occurs only during automated build processes and if you use an EAP      method which needs user interaction – as I don’t do that I can’t comment      on this hotfix.
For more information please go through this link:
http://robert.penz.name/555/list-of-ieee-802-1x-hotfixes-for-windows-7/
Best Regards:
Muhammad Munir

Posture setup in Cisco ISE

Dears
I am trying to configure the posture for the ISE but the result is always " Posture status : pending " and the agent can access all network resources without any problem .
please help

Please review the below steps:
Step 1 Choose Administration > System > Deployment > Deployment.
The Deployment navigation menu appears. Use the Table view or the List view button to display the
nodes in your deployment.
Step 2 Click the Table view.
Step 3 Click the quick picker (right arrow) icon to view the nodes that are registered in your deployment.
The Table view displays all the nodes that are registered in a row format in the Deployment Nodes page.
The Deployment Nodes page displays the Cisco ISE nodes that you have registered along with their
names, personas, roles, and the replication status for the secondary nodes in your deployment.
Step 4 Choose a Cisco ISE node from the Deployment Nodes page.
Note If you have more than one node that is registered in a distributed deployment, all the nodes that
you have registered appear in the Deployment Nodes page, apart from the primary node. You
have the option to configure each node as a Cisco Cisco ISE node (Administration, Policy
Service, and Monitoring personas) or an Inline Posture node.
Step 5 Click Edit.
The Edit Node page appears. This page contains the General settings tab that is used to configure the
Cisco ISE deployment. This page also features the Profiling Configuration tab, which is used to
configure the probes on each node.
Note If you have the Policy Service persona disabled, or if enabled but the Enable Profiler services
option is not selected, then the Cisco ISE administrator user interface does not display the
Profiling Configuration tab. If you have the Policy Service persona disabled on any Cisco ISE
node, Cisco ISE displays only the General settings tab. It does not display the Profiling
Configuration tab that prevents you from configuring the probes on the node.
Step 6 On the General settings tab, check the Policy Service check box, if it is already active.
If the Policy Service check box is unchecked, both the session services and the Profiler service check
boxes are disabled.
Step 7 For the Policy Service persona to run the Network Access, Posture, Guest, and Client Provisioning
session services, check the Enable Session Services check box, if it is not already active. To stop the
session services, uncheck the Enable Session Services check box.
The posture service only runs on Cisco Cisco ISE nodes that assume the Policy Service persona
and does not run on Cisco Cisco ISE nodes that assume the administration and monitoring
personas in a distributed deployment.
Step 8 Click Save to save the node configuration.

Cisco ISE NAM Distribution/Deploy GPO AD

Similar Messages

Maybe you are looking for