Cisco VM server based ISE deployment in out of Band

Hi,
can any one please share the link of Configuration guide for VM based Cisco ISE in out of band deployment model.
Regards,
Awais

Similar Messages

Precalculation SAP Server Capacity before deploy Roll Out Project

Hello Experts,
Kindly any one share your great experience to help our requirement.
We are planning to implement new business scenarios and new client in existing Production server.
Before deploy new business functionalists, what are factors need to consider in existing Production server.
How to precalculate SAP server capacity to adopt new functionality, how affect workload, performance, memory..etc..
Kindly any one the list of factors.. and some standard document.
Regards,
Karthik

Hi Karthik,
First find out the 'capacity' of your current server hardware. Ask the HW provider for the SAPS number of the machines, or look it up on SAP's benchmark sides http://service.sap.com/benchmarks
Then monitor the current usage of your servers to find out how many SAPS you need for the existing functions, and how much headroom you have left.
And for the new functions, look whether some sizing guideline exists (http://service.sap.com/sizing) or if a sizing for the new application is implemented in the quicksizer tool.
With that, it should be a simple a + b = c type calculation.
Best Regards, Randolf

SCCM out of band management

SCCM has out of band managment ability, and it has a check box:
"Enable BIOS password bypass for power on and restart command"
I am not sure the meaning of BIOS passwrod since we could set both power on password and hdd password in BIOS.
It means we could bypass both power on password and hdd password?

Anoop,
Will you help by explaining on this in detail?
Kindly let me know which is the best ipmi tool to be used to display the server
hardware details in SCOM management packs while I have to monitor at least 300 servers. I am aware of IPMITool.exe. IPMIUtil.exe etc. Same time,
I am concerned about following points:
1. Performance impact in a agent based system
2. Performance impact in a agentless scom system
3. Performance impact if the executable is running only in SCOM server
4. Retrieving data out of band directly from BMC while OS is not running
5. Is there any solution to avoid binding issues with BMC when concurrent calls are
made by such tools to retrieve out of band inventory (IPMI) details.
How to handle binding issues?
regards
scomdev
SCOMDev

Out of Band Management aka Lights Out ala ALOM/LOM/iLO ?

I'm researching Xserve hardware for a project at work and am having a hard time finding out if these are real servers or not.
By real server I mean that an out of band lights out management facility is there. One which would allow you to connect via serial or network (preferred) to a service processor. The service processor would then let you power the machine on/off, change firmware settings to ie: boot from network on the next boot, or from disk 3 or what-have-you.
It should also give you access to the text console at a minimum once the os has loaded, and optionally let you see the gui (if there is any graphics adaptor installed).
Something akin to Sun's LOM or ALOM, or HP's iLO facilities.
If it isn't there, then this project isn't going to work with Xserves.

Like you, I'm very familiar with Sun various LOM implementations. The ALOM is, IMHO, by far the most useful one [RSC supports telnet not SSH; eLOM is IPMI 2.0 like Apple but very clunky to work with in the CLI].
The IPMI BMC present in the Xserve has a ton of capabilities, including Serial-over-LAN (SOL) for remote console access, but most features are (currently) unused. Apple ships the open-source ipmitool, as does Sun on S10 x64 systems, but no man pages (sourceforge has them); I think this is telling about how much effort has been put in to the Lights Out capability so far. I have been able to remotely query the Xserve LOM using ipmitool (from a Sun box) for various environmental conditions and to simply power-on/off the box. The GUI Server Manager client has equivalent functionality.
While I can enable the SOL capability with ipmitool, I don't (yet) know how to connect for serial console access. One other point of frustration so far has been that the RS-232 console port on the Xserve is only used for getty to listen on; thus if the box is not fully booted, the console port does no good whatsoever.
Don't get me wrong though; we are slowly replacing our Sun equipment with Xserve systems, as they offer much greater capability and easier management (in general) at a significantly lower cost than Sun. I just wish Apple would fix some of the basic Lights Out functionality that we have come to expect.
Xserve Quad Xeon Mac OS X (10.4.9)

Cisco ISE Deployment suggestion required

Require Assistance on Cisco ISE Deployment for below scenario
-- We have Three Cisco ISE Appliances and Client has taken Advance Subscription License for 500 users
-- Client has DC & DR and needs to deploy the Cisco ISE in one Main Office which connects to DC & DR on MPLS Links
-- Client suggestion was to deploy one ISE node ( Admin + M&T + Policy Server ) in DC and its Standby Secondary in DR
     and only deploy Policy Server in Main Office.
     Idea behind the design is that ,
     1) If DC fails , Cisco ISE related logs will get generated on DR and any Cisco ISE related request will be taken care by Local Policy Server in Main Office .
      2) If Local Policy Server Fails , then ISE node in DC will act as Secondary backup and DR will act Teritary Backup
      below is view
                                     DC
                        Primary Node with Role
                   [Admin , M&T , Policy Server]
                                                                                                             Main Remote Offic
                                                                                                              Cisco ISE Node ( Only Policy Server) -----------> Network Devices
                               DR
                       Secondary   Node with Role
                   [Admin , M&T , Policy Server]
Please let me know is it possible

Yes, The scenario is quite achievable also please review the below link for assistance on deployment of ISE.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_50_ise_deployment_tg.pdf
http://www.cisco.com/en/US/docs/security/ise/1.0/install_guide/ise10_deploy.pdf

Cisco QM/Calabrio - server based recording - how many NICs?

I'm looking to replace a Verint system that is doing server-based recording with Call Mgr 4.1.3. We are going to upgrade to 7.1.x soon.
My customer is a CCX CAD/Citrix environment. I see that QM/Calabrio also supports server-based recording.
We have a number of subnets that we need to SPAN. I have a couple of questions:
1) How many recording NICs can be in one QM recording server? Verint can do 4 plus a management NIC.
2) How many recording servers can be supported? We also have a remote WAN location that needs a recording server.
3) Does QM require an MCS server to run, or will it install on general server hardware (we are an IBM shop and have the servers.)
Thanks.

Questions about Cisco Call recording and Quality Management or Workforce management should be posted
under the Contact Center Applications at https://www.myciscocommunity.com/community/partner/collaboration/contactcenter/apps
I am checking some of the details for question 1 & 2 and will respond to your questions in a few hours
for 3 The QM application can be deployed on MCS or MCS equivelent servers as determined by the partner/customer

Cisco ISE Deployment issue

Hi dears,
I deployed the ISE primary and secondary mode. Then I did deregister the secondary ISE at Primary ISE. Now i want to register the same second ISE as secondary mode on Primary ISE. but this error occur:
Unable to register SecondaryISE. Node is not a Standalone node.
I connect the secondary ISE and see deployement personas
Administration: Secondary
Monitoring: Secondary
Then I did promote to primary command after that ISE is log out but the problem is not solve.
version 1.20.8xx of both ISE's
How i solve this issue?
Thanks

try by promoting the secondary ISE which you have de-registered to standlone and try registering it on primary now

ISE Deployment - Limit on Radius Sources?

Greetings,
I am planning a change to our ISE deployment, and I am curious if there is a limitation to the number of Radius sources that can be added to the running config on the switches and APs.
The majority of the switches are 2960 series and the APs are 2602 models.
Currently, we have two Radius Sources configured as follows:
aaa group server radius rad_eap
server X.X.X.X auth-port 1645 acct-port 1646
server X.X.X.X auth-port 1645 acct-port 1646
I need to know if I am able to add a third entry to that list, or if there is a hard limitation I am unaware of.
Thank You.

ISE questions will probably get more traction in the Security forum.
That said, the answer is "it depends". It all depends on your design. Is your third server a Policy Services Node or an Inline Posture Node (IPEP)? Either way, one of those would generally be positioned so as to provide profiling, posture and enforcement services working in conjunction with the Admin server(s). If a server is not part of the overall architecture, it will not.
All new ISE designs should be based on the Cisco-approved High Level Design (HLD) template. If you follow that and develop your Low Level design based on it, many of the typical questions should be answered.
Hope this helps.

NAC Out-of-Band Deployment for wireless networks

I am evaluating the NAC appliance for my wired and wireless users. I have read that the only way to deply NAC for wireless is in-band mode but it looks like the following link says that it is possible to deply NAC for wireless networks in-band or out-of-band mode:
"NAC Appliance can be deployed for WLANs as an in-band deployment for full-time endpoint scanning or out-of-band within a central site for periodic scanning to confirm posture compliance. The NAC Appliance server performs authentication, posture assessment, and remediation. The server securely controls authenticated and unauthenticated user traffic by managing traffic policies based on protocol/port or subnet, providing bandwidth policy management based on shared, or per-user bandwidth, or using time-based sessions and heartbeat controls. (Figure 1)"
http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps6521/prod_brochure0900aecd80355b2f_ps6128_Products_Brochure.html
Does anyone know if it is possible to use NAC out-of-band deployment for wireless networks? If you can point me to some documentation it will be appreciated.
Regards

Thanks Robert.
In my case I am planning to deploy a central NAC appliance at the main office to control some branch offices and local wired users at the main office. The NAC appliance will operate in out-of-band mode. But for wireless users at the main office I will need an aditional NAC appliance operating in in-band mode, is this correct?
Regards

Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

With Eric Yu and Todd Pula
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE).
Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.
Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi Antonio,
Many great questions to start this series. For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent? Does the problem happen for one WLAN but not another? As it stands today, the CoA-Ack needs to be initiated by the management interface. This limitation is documented in bug CSCuj42870. I have provided a link for your reference below. If the problem happens 100% of the time, the two configuration areas that I would check first include:
On the WLC, navigate to Security > RADIUS > Authentication. Click on the server index number for the associated ISE node. On the edit screen, verify that the Support for RFC 3576 option is enabled.
On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question. On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked. When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface. Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface. As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
Bug Info: https://tools.cisco.com/bugsearch/bug/CSCuj42870
For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request. We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered. Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers. For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
As for product roadmap questions, we won't be able to discuss this here due to NDA. Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
Related Info:
Wireless BYOD for FlexConnect Deployment Guide

Cisco Identity Services Engine (ISE) Version 1.2: What's New in Features and Troubleshooting Options

With Ali Mohammed
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about what’s new in Cisco Identity Services Engine (ISE) Version 1.2 and to understand the new features and enhanced troubleshooting options with Cisco expert Ali Mohammed.
Cisco ISE can be deployed as an appliance or virtual machine to enforce security policy on all devices that attempt to gain access to network infrastructure. ISE 1.2 provides feature enrichment in terms of mobile device management, BYOD enhancements, and so on. It also performs noise suppression in log collection so customers have greater ability to store and analyze logs for a longer period.
Ali Mohammed is an escalation engineer with the Security Access and Mobility Product Group (SAMPG), providing support to all Cisco NAC and Cisco ISE installed base. Ali works on complicated recreations of customer issues and helps customers in resolving configuration, deployment, setup, and integration issues involving Cisco NAC and Cisco ISE products. Ali works on enhancing tools available in ISE/NAC that are required to help troubleshoot the product setup in customer environments. Ali has six and a half years of experience at Cisco and is CCIE certified in security (number 24130).
Remember to use the rating system to let Ali know if you have received an adequate response.
Because of the volume expected during this event, Ali might not be able to answer each question. Remember that you can continue the conversation on the Security community, sub-community shortly after the event. This event lasts through September 6, 2013. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Ali,
We currently have a two-node deployment running 1.1.3.124, as depicted in diagram:
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_010.html#ID89
Question 1:
After step 1 is done, node B becomes the new primary node.
What's the license impact at that stage, when the license is mainly tied to node A, the previous primary PAN?
Step 3 says to obtain a new license that's tied to both node A & node B, as if it's implying an issue would arise, if we leave node B as the primary PAN, instead of reverting back to node A.
=========
Question 2:
When step 1 is completed, node B runs 1.2, while node A runs 1.1.3.124.
Do both nodes still function as PSN nodes, and can service end users at that point? (before we proceed to step 2)
Both nodes are behind our ACE load balancer, and I'm trying to confirm the behavior during the upgrade, to determine when to take each node out of the load balancing serverfarm, to keep the service up and avoid an outage.
===========
Question 3:
According to the upgrade guide, we're supposed to perform a config backup from PAN & MnT nodes.
Is the config backup used only when we need to rollback from 1.2 to 1.1.3, or can it be used to restore config on 1.2?
It also says to record customizations & alert settings because after the upgrade to 1.2, these settings would change, and we would need to re-configure them.
Is this correct? That's a lot of screen shots we'll need to take; is there any way to avoid this?
It says: "
Disable services such as Guest, Profiler, Device Onboarding, and so on before upgrade and enable them after upgrade. Otherwise, you must add the guest users who are lost, and devices must be profiled and onboarded again."
Exactly how do you disable services? Disable all the authorization policies?
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_01.html#reference_4EFE5E15B9854A648C9EF18D492B9105
==================
Question 4:
The 1.1 user guide says the maximum number of nodes in a node group was 4.
The 1.2 guide now says the maximum is 10.
Is there a hard limit on how many nodes can be in a node group?
We currently don't use node group, due to the lack of multicast support on the ACE-20.
Is it a big deal not to have one?
http://www.cisco.com/en/US/customer/docs/security/ise/1.2/user_guide/ise_dis_deploy.html#wp1230118
thanks,
Kevin

Question about out-of-band when deploying NAC

1. When I deploy NAC, a PC or user device is on the certified list. If User device is infected by virus, NAC Server can recognize device which is infected and prevent PC or not when I deploy out-of-band (not in-band)?
2. When I deploy out-of-band, cisco nac appliance can configure bandwidth for group users or not?
Thank you for your answer.
Duy Khang

1) Answer: No. Clean Access (NAC Appliance) will not detect when a system is infected with a virus, regardless of which deployment (In-Band or Out of Band) is used.
2) Answer: No. When deployed out of band, once the posture is completed, the client traffic no longer goes through the Clean Access server so there is no way to apply bandwidth or any other controls to it via Clean Access. In order to apply bandwidth or access restrictions via CCA, the CCA server would have to be in-band.

I can use the Cisco TelePresence Server MSE 8710 without VCS or CUCM

Hi all,
We are planning install Cisco TelePresence Server MSE 8710 for our customer.
we haven´t install this equipment, then we need know if is possible install the Cisco TelePresence Server MSE 8710 standalone, like a MCU, without a CUCM or VCS.
Regards,
GSilva

It should be possible to reach the device via ip for sip and h323 without a call control,
but as the TPS does not have an IVR this might not work out for the typical IP dialing target group.
Even if its a bit outdated (seems not to be EOL though), the 8510 MCU can be an option as the stand alone IP support might be better.
If you want to move to the TPS 8710 later you can migrate it later as well, its the same hardware.
It would be interesting to hear how the current deployment and setup looks
like and what benefits you see on deploying it without CUCM or VCS and how your requirements / use case are.
This here seems to be a special case, for new setups I would recommend to use CUCM, Conductor and TPS.

Integration of Cisco Fax Server with CUCM

Need some help with regards to the setup of Cisco Fax Server. I have Cisco Fax Server 9.4 Enterprise Suite which will be installed on Cisco 7816 server. Now my concern is with the integration of Fax server with CUCM. I have CUCM Ver 7. Could anyone tell me what configuration is required on CUCM and I believe we need to have dial-peer on the Voice gateway as well pointing to the Fax server. If anyone has deployed then please let me know the configuration on CUCM & the voice gateway.

Hi..
Thank u so much guys. I was mostly looking out for the integration of Fax server with CUCM, so i think this document should help. I has this document with me but had few doubts. Hopefully it should be cleared now. I will be doing the implementation later next week so i will keep you updated. Anyway thank u so much once again.
Regards,
Joy

Server 2008 R2 DFS Drop Outs

I have a problem with a Server 2008R2 running DFS, 3 out of 4 Folders drop out - I just can't figure out what on earth is going on.
It is a Domain based DFS, the namespace is called 'dfs' - e.g.
\\domain\dfs, I have 4 Folders called "MyDocs", "Home", "Shared" and "Software" - all of these have a cache duration of 1800 seconds.
"MyDocs" is used with My Documents Folder Redirection, Home, Shared and Software are used with Group Policy Preference based drive mappings.
The problem I have is the Home, Shared and Software Folders simply disappear, thus mapped drives become unavailable. The problem can occur as frequently as every 5 minutes or if I'm lucky, I'll get half an hour of solid reliable DFS usage.
I half suspect I'm not having a problem with the MyDocs Folder because it's linked to Offline files and Windows 7 Offline Files uses background sync.
One thing I will point out, the problem only surfaced after I upgraded my Lenovo laptop to Windows 7 Ultimate x64 SP1, it did not exist when I was running Windows 7 Professional x64 (no SP). Another laptop on the network (Sony VAIO - differnet
WLAN NIC), it's still running Windows 7 x64 Professional (no SP), uses the same WLAN and it never has a problem.
I have spent months investigating the potential for this to be a WLAN card (Intel Centrino 6200) and I have noticed other people reporting similar mapped network drive issues on the Lenovo forums (also using these Centrino model WLAN
cards).
The problem occurs almost immediately if I try to transfer a large amount of data over the WLAN, e.g. don't bother trying to copy an ISO as will cause the DFS Folders (Home/Software/Shared) to drop-out almost immediately and the copy borkes out. The problem
does not occur if I transfer the same ISO over wired LAN ethernet.
I can't get past the fact that this problem didn't occur when running Win 7 Pro with no SP1, I'm not 100% inclined to think this is a hardware or WLAN card issue.
I have screwed around with WLAN drivers, power management settings etc etc etc, jack of that. It's achieved nothing.
I have installed KB983620 but this has had no effect.
A few things I have noticed:
* When the DFS Folders come back online, the Application Experience service on the Windows 7 client has literally just (re)started. As a test, sometimes I'll manually restart it and the Folders will reappear almost immediately after (doesn't
work every time).
* Restarting the TCP/IP NetBIOS Helper Service can help force the Folders to come back online (also doesn't work every time)
* Repeatedly browsing the still functional MyDocs DFS Folder (which never drops out) can help prompt the other DFS Folders to reappear (also doesn't work every time)
* I have noticed when the 3 DFS Folders are not available via
\\domain.local\dfs\, they will be available via
\\domain\dfs and vice versa
* If I run dfsutil /pktinfo - when the 3 Folders are unavailable, the TTL for Home, Shared, Software is sitting at 0 (MyDocs on the other hand is not, it's still counting down). When things are functioning properly, the TTL is counting down for all
of them from 1800, when it reaches 0, it starts from 1800 again.
Any ideas?
Ben

Hello Ben,
From your explanation it seems it is wireless issue? can you look in to the event logs of the machine affected and see what event ID is being reported? Also, possibility might be DNS because you said it works with
\\domain\dfs but fails with
\\domain.local\dfs?
Can you check your wireless settings to see what is the max data size that can go through if there are such restrictions
Isaac Oben MCITP:EA, MCSE,MCC
View my MCP Certifications
Hi Isaac
Thanks for the reply.
At first and over the past few weeks I've been thoroughly investigating the possibility this is a Wireless issue. Messing around with drivers (Lenovo, Intel, versions, settings, I've tried it all). But there are some factors I can't ignore that lead
me to think maybe this is not specifically a Wireless issue.
The problem only started after I upgraded to Windows 7 Ultimate with Service Pack 1 - the problem never occured with Windows 7 Professional (no SP, both x64)
When I first started troubleshooting I was using
\\domain\dfs, but then I realised when I was having the problem I could still access the folders via
\\domain.loca\dfs. Now I've realised it's a case of when fqdn is working, non-fqdn might not be and when non-fqdn is working, fqdn might not be and sometimes both are not.
No specific events are being generated. Any suggestions?
Any idea where I check max data rate?
Thanks,
ben

Cisco VM server based ISE deployment in out of Band

Similar Messages

Maybe you are looking for