CWA using Cisco ISE issue

Good morning everyone,
I have some trouble to use my Cisco ISE to do Central Web Authentication. I followed this following configuration example : http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html
But for the moment, clients can't seee the web portal. My WLC and my Cisco ISE are well configured as presented in the document, when clients connect to the AP, they are listed into the Cisco ISE with the good authorization profile but, the URL redirection doesn't work as well as I want, clients have to enter manually the IP address in the web browser to log-in trough the Cisco ISE.
If anyone already had this problem, maybe could tell me more about that.
Thanks in advance!

Good news!
I have resolved my problem 15 minutes ago. For people who have the same problem, I have just changed my static route in my WLC. The issue was that I broadcast the same VLAN used for the management interface and in adding the network allowing admin to reach service-port, all traffic of my broadcasted VLAN was sent to the service-port. A simple netmask modification resolved the problem.
I have still a problem with CoA which doesn't work properly and I have to disconnect/reconnect to the SSID to have a complete access but I'm going to continue my research for that.
Thanks all for your help !!!!

Similar Messages

Reauthentication Problem in Endpoints Using Cisco ISE 1.1

Hi,
Can anyone suggest me if laptop/desktop goes on sleep mode or keep connected with interace configured for 802.1X for more than 12 hours it does not work or not connect to Exchange server, Cisco ISE console, office communicator...
for re authentication i need to restart PC/ Laptop or unplug and replug lan cable from it!
but before restartiong i am able to ping all DNS, DHCP, OCS, everything....
below is the interface configuration
sh running-config interface gigabitEthernet 3/0/19
Building configuration...
Current configuration : 909 bytes
interface GigabitEthernet3/0/19
description Access Ports
switchport access vlan 309
switchport mode access
ip access-group ACL-ALLOW in
no logging event link-status
power inline never
srr-queue bandwidth share 1 60 30 10
srr-queue bandwidth shape 10 0 0 0
priority-queue out
authentication control-direction in
authentication event fail action next-method
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
mls qos trust dscp
dot1x pae authenticator
dot1x timeout tx-period 10
no cdp enable
spanning-tree bpduguard enable
spanning-tree guard loop
service-policy input access_in
ip dhcp snooping limit rate 20
end

Hi Sachin,
Thanks for your prompt response. Here is the port configuration. My users are connected behind Cisco IP Phone & We are using CWA for wired guest as well.
interface GigabitEthernet0/1
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30
interface GigabitEthernet0/1
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30
Thanks

CISCO ISE ISSUE 24206 User disabled

Hi there,
We have here an issue with Cisco ISE. When I create a guest account with the sponsor portal We can´t access the Wlan. On tne Cisco ISE Operations \ Authentications returns the error message Event "Authentication" Faulure Reason "24206 User Disabled" Auth Method "PAP_ASCII" Authentication Protocol "PAP_ASCII"
In order to fix this issue, what can I do? I don´t understand why because I can create the user withou error message.
At the sponsor portal the user that I have created doens´t show at the list...
Any help??
Regards
Adriano

Select the affected account and click Reinstate.
It is possible, that your sponsor account does not have the permission to Reinstate/Suspend accounts. Check/change this in your ISE admin page:
- Go to Administration > Guest Management > Sponsor Groups.
- Click the Sponsor Group your sponsor account is a member of to edit.
- Select tab Authorization Levels: view/modify the permission listed for the option Suspend/reinstate Accounts.
ref: https://supportforums.cisco.com/discussion/11431386/ise-guest-user-problem

Delete language template in use Cisco ISE

Hi I have a problem updating my ise, there is a faulty language template in use as I can see in the log files, its not a system template so I want to proceed to delete it, but I can't because its still in use by a sponsor or a user, the problem is that sponsor grups had this option *Maximum Duration of Account set to 999999.
Is there a way to logout all sponsors (they are not local users)?
this is the output log when updating the ise, I had to open a TAC case because my firs support couldn´t update form the latest 1.1.4 to 1.2
PortalConfigUpgradeUtil: getInstance
adding default attributes to SponsorUser.
UpgradeUtil: Add attribute: DefaultGuestRole to object type: SponsorUser
UpgradeUtil: Added attribute: DefaultGuestRole
UpgradeUtil: Add attribute: DefaultTimeProfile to object type: SponsorUser
UpgradeUtil: Added attribute: DefaultTimeProfile
UpgradeUtil: Add attribute: DefaultLanguageNotification to object type: SponsorUser
UpgradeUtil: Added attribute: DefaultLanguageNotification
UpgradeUtil: Add attribute: LoginUsername to object type: SponsorUser
UpgradeUtil: Added attribute: LoginUsername
Setting default attributes on SponsorUser ...
upgrade default attributes for sponsoruser: 175fa0e0-8969-11e1-8db8-005056b00068
upgrade default attributes for sponsoruser: domainuser1
upgrade default attributes for sponsoruser: domainuser2
failed to update sponsor user: Invalid Language Template: Spanish
com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: Invalid Language Template: Spanish
    at com.cisco.cpm.guest.impl.SponsorUserImpl.save(SponsorUserImpl.java:916)
    at com.cisco.cpm.guest.upgrade.PortalConfigUpgradeUtil.updateDefaultSponsorUserAttributes(PortalConfigUpgradeUtil.java:149)
    at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgradeGuestDefaults(GuestUpgradeService.java:3154)
    at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgrade(GuestUpgradeService.java:349)
    at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.UpgradeServices(UpgradeServiceRegistrar.java:131)
    at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.main(UpgradeServiceRegistrar.java:184)
GuestUpgradeService: Failed to upgrade guest defaults Invalid Language Template: Spanish
Error while applying changes in version: 1.2.0.882 class: com.cisco.cpm.guest.upgrade.GuestUpgradeService
com.cisco.cpm.infrastructure.upgrade.api.UpgradeFailureException: com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: Invalid Language Template: Spanish
    at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgradeGuestDefaults(GuestUpgradeService.java:3162)
    at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgrade(GuestUpgradeService.java:349)
    at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.UpgradeServices(UpgradeServiceRegistrar.java:131)
    at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.main(UpgradeServiceRegistrar.java:184)
Caused by: com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: Invalid Language Template: Spanish
    at com.cisco.cpm.guest.impl.SponsorUserImpl.save(SponsorUserImpl.java:916)
    at com.cisco.cpm.guest.upgrade.PortalConfigUpgradeUtil.updateDefaultSponsorUserAttributes(PortalConfigUpgradeUtil.java:149)
    at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgradeGuestDefaults(GuestUpgradeService.java:3154)
    ... 3 more
ERROR! isedataupgrade.sh FAILED. ISE GLOBAL DATA UPGRADE FAILED
After a clean install to 1.2 and installing the backup of 1.1.4 I get the same error
failed to update sponsor user: Invalid Language Template: Spanish
com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: Invalid Language Template: Spanish
     at com.cisco.cpm.guest.impl.SponsorUserImpl.save(SponsorUserImpl.java:916)
     at com.cisco.cpm.guest.upgrade.PortalConfigUpgradeUtil.updateDefaultSponsorUserAttributes(PortalConfigUpgradeUtil.java:149)
     at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgradeGuestDefaults(GuestUpgradeService.java:3154)
     at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgrade(GuestUpgradeService.java:349)
     at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.UpgradeServices(UpgradeServiceRegistrar.java:131)
     at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.main(UpgradeServiceRegistrar.java:184)
GuestUpgradeService: Failed to upgrade guest defaults Invalid Language Template: Spanish
Error while applying changes in version: 1.2.0.882 class: com.cisco.cpm.guest.upgrade.GuestUpgradeService
com.cisco.cpm.infrastructure.upgrade.api.UpgradeFailureException: com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: Invalid Language Template: Spanish
     at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgradeGuestDefaults(GuestUpgradeService.java:3162)
     at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgrade(GuestUpgradeService.java:349)
     at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.UpgradeServices(UpgradeServiceRegistrar.java:131)
     at com.cisco.cpm.infrastructure.upgrade.impl.UpgradeServiceRegistrar.main(UpgradeServiceRegistrar.java:184)
Caused by: com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: Invalid Language Template: Spanish
     at com.cisco.cpm.guest.impl.SponsorUserImpl.save(SponsorUserImpl.java:916)
     at com.cisco.cpm.guest.upgrade.PortalConfigUpgradeUtil.updateDefaultSponsorUserAttributes(PortalConfigUpgradeUtil.java:149)
     at com.cisco.cpm.guest.upgrade.GuestUpgradeService.upgradeGuestDefaults(GuestUpgradeService.java:3154)
     ... 3 more
ERROR! isedataupgrade.sh FAILED. ISE GLOBAL DATA UPGRADE FAILED

Hi, Alexander De Menezes from the tac team helped me to solve this issue, it is related to the internal oracle database.
Kind regards

Posture Assessment passed in Error using Cisco ISE

Hi all,
I would like some help trying to understand why a client that has not been connected to the network for just over a month was allowed full network access despite the AV definitions being over 28days old.
We have 2 mandatory posture requirements,
1. Symantec Av MUST be installed
2. the AV definitions MUST be LESS THAN 28 days out of date
Currently, the machine I have is showing the AV defs as being 25th March 2013.
When I produce the detailed posture report, it even shows me that the two mandatory requirements as described above were successfully meant meaning the endpoint is posture compliant. Clearly this is not the case though...!
Is there anything else I can check on the ISE to help debug this?
Mario

Hi,
You might have two problems:
1. In ISE you have a gobal setting regarding the unsupported NAC Agent clients (Android, etc) that specifies what is their default compliance status. If the default setting is "compliant" and you don't have a provisioning rule for that client or you simply don't have client provisioning rules, any machine that doesn't fit in the provisioning rule (ie ISE thinks that is not supported) will get a compliance status of compliant event though NAC Agent is installed and the rules are not satisfied.
2. NAC Agent version problem?
I've seen in logs that you're using NAC Agent 4.9.1.6 but the latest recommended version of NAC Agent to be used with (the latest) ISE is version 4.9.0.51.
Version 4.9.1.6 is a NAC Appliance release and Cisco offers no guarantee that is 100% compatible with ISE.
Check
http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html#wp78131
Cisco NAC Agent Interoperability Between NAC Appliance and Identity Services Engine (ISE) Cisco supports different versions of the NAC Agent for integration with NAC Appliance and ISE. Current releases are developed to work in either environment, however, interoperability between deployments is not guaranteed. Therefore, there is no explicit interoperability support for a given NAC Agent version intended for one environment that will necessarily work in the other. If you require support for both NAC Appliance and ISE using a single NAC Agent, be sure to test NAC Agent in your specific environment to verify compatibility. Unless there is a specific defect or feature required for your NAC Appliance deployment, Cisco recommends deploying the most current agent certified for your ISE deployment. If an issue arises, Cisco recommends restricting the NAC Agent's use to its intended environment and contacting Cisco TAC for assistance. Cisco will be addressing this issue through the standard Cisco TAC support escalation process, but NAC Agent interoperability is not guaranteed. Cisco is working on an approach to address NAC Agent interoperability testing and support in an upcoming release.

Cisco ISE - Not use FQDN in url-redirect parameter

Hi,
I am using Cisco ISE Central Web Authentication for Guest Wireless. Clients are redirected for web authentication to: https://ip:port/guestportal/gateway?sessionId=SessionIdValue&action=cwa as it is specified by the url-redirect parameter in the Authorization Profile.
The “ip” field in the url is now replaced by the FQDN of the Cisco ISE, but I want to use the IP address instead of the FQDN. Is there any way to do that?
As far as I know in version 1.2 you can use the “ip host/no ip host” command to indicate what you want to use in the URL. However my Cisco ISE is running version 1.1.1.268.
Thank you very much.
Joana.

Available in 1.2, and available as a "bit of a bodge" in 1.1.x (read "a lot of a bodge")
If you only have one PSN then you may be able to get it to work, but after that you lose the ability to get the session to be pointed automatically at whichever PSN they hit initially so it would break.
Copy the settings that are applied when you use CWA, then create your own based on the same settings but using the ip address pasted in there instead.

Cisco ISE IP Renewal not working

Hi all,
I am setting up a CWA with Cisco ISE to authenticate Guests and Employees by Web and assign them to Two different vlans. The authentication pass. The authZ Profiles are affected. but The IP address did not change according to vlan until I renew it manually from console ( >ipconfig /release >ipconfig /renew). I desactivated Java in browsers, I activated it again and added the IP of the ISE to the Exception List in Java setting but the IP address still not change automatically.
Any Ideas how to fix this Issue?
Thank you.

Hi Bouchaib,
Make sure you have put a check on the VLAN DHCP Release option.
If you are using ISE 1.3 then your path will be,
Guest Access > Configure > Guest Portals > Create, Edit or Duplicate > Portal Behavior and Flow Settings > VLAN DHCP Release Page Settings.
This affects the Central WebAuth (CWA) flow during final authorization when the network access changes the guest VLAN to a new VLAN. The guest’s old IP address must be released before the VLAN change and a new guest IP address must be requested through DHCP once the new VLAN access is in place. The IP address release renew operation varies by the browser and operating system used; Internet Explorer uses ActiveX controls, and Firefox and Google Chrome use Java applets. For non-Internet Explorer browsers, Java must be installed and enabled on the browser.
The VLAN DHCP Release option does not work on mobile devices. Instead, guests are requested to manually reset the IP address. This method varies by devices. For example, on Apple iOS devices, guests can select the Wi-Fi network and click the Renew Lease button.
For ISE 1.2 version, you can find the same option on the Guest Portal settings.

Ordering Cisco ISE

Hi Everyone,
We are a Small company with 400-Users and currently we are using ACS 4.2 at our company. we want to upgrade and use Cisco ISE Appliance instead.
I want to know is there any major changes in configurtaion between ACS 4.2 and the ISE Latest Verison..............?
Is there any Hardware (Switch or Cisco AP ) compatibility issues with using Cisco ISE. (we are currently using Cisco Cat 3550 and Cisco Aironet 2600 APs with the existing ACS4.2)
What ISE Series & what Soft version are the latest so i can order ?
Thank You

Imran,
When ordering cisco ISE there are certain SKUs that will allow you purchase and deploy the equipment, however there are conditions where you will have to rely on an ATP to prepare, plan and implement the solution for you. Here is the information that you are looking for along with the hardware compatibility matrix.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/guide_c07-656177.html
Q/A - (column indicates which ISE skus are ATP madantory)
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/qa_c67-658591.html
Network component compatibility matrix -
http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html
Tarik Admani
*Please rate helpful posts*

Cisco ISE - multiple AD - trust relationships

Hello,
I have a customer who has multple AD forests and an ISE deployment running 1.1.3.
The customer scenario is as follows - there is an Internal AD forest (internal users) and an External AD forest (external users such as consultants). The objective is to use Cisco ISE to authenticate and authorize the users in both AD forests. CIsco ISE is connected to the Internal AD forest.
We know that multiple AD support is coming in 2014 with versioon 1.3 - other options such as LDAP/EAP-TLS are not a viable option for the customer.
1.       Currently – the Internal AD forest has an External, Non-transitive – one-way trust with the External Forest
     a.       The objective here is to use a feature called Selective Authentication in order to filter the outgoing requests from the External Forest to the Internal Forest – this is a selective trust feature that can be used to control access to specific resources in Internal Forest and for authentication between Internal/External Forest via Cisco ISE
     b.      Preliminary testing has shown that a one way trust seems to work for Cisco ISE authentication/authorization
     c.       Further testing is underway to test the Selective Authentication feature (ie restrict access to specific resources etc…)
Question : has any one used this and is this a supported method by Cisco (I know they mention a mutual trust relationship is required)?
2.       We are exploring a second scenario - the Internal AD forest will have an External, Non-transitive – two-way trust with the External Forest
     a.       Same objectives as in 1 – we would attempt to use the Selective Authentication in the following fashion (this is an example)
          i.      External Forest has outgoing filter to allow access to specific resources in Internal Forest, and for authentication
          ii.      Internal Forest has incoming filter to deny access to all resources in External Forest
In this case we would filter so it resembles a 1 way trust relationship - anyone try this, anyone know if this would be a supported method by Cisco?
Thanks in advance for your replies.
Robert C.

Cisco has published a nice new guide on Active Directory integration with ISE 1.3. As noted there:
"Cisco ISE can connect with multiple Active Directory domains that do not have a two-way trust or have zero trust between them. Active Directory multi-domain join comprises a set of distinct Active Directory domains with their own groups, attributes, and authorization policies for each join."
I've setup one such deployment just recently and found it quite simple to just add the second domain and use it an en external identity source accordingly.

Guest Wireless Cisco ISE 1.3

I am setting up guest wireless in my enterprise using Cisco ISE 1.3.
I have set up Authorization profiles and Authentication conditions for Guest Wireless. I am however not sure of the Authentication results (the allowed protocol section). Since I want to give Guests INTERNET-ONLY access, I have configured WLC with a ACL and tied that ACL-name to ISE. However, when it comes to Authentication results à Allowed protocols, I am unsure of what to include. For instance, I have created an allowed protocol named ‘Wireless_Access’, screenshot attached below..
Please let me know what options have to be checked to suit a guest environment. Any help would be much appreciated.. thanks!

Hi,
Below you can find a configuration example for guest access using ISE1.3.
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html
Hope this helps.
Regards

Cisco ISE with TACACS+ and RADIUS both?

Hello,
I am initiating wired authentication on an existing network using Cisco ISE. I have been studying the requirements for this. I know I have to turn on RADIUS on the Cisco switches on the network. The switches on the network are already programmed for TACACS+. Does anybody know if they can both operate on the same network at the same time?
Bob

Hello Robert,
I believe NO, they both won't work together as both TACACS and Radius are different technologies.
It's just because that TACACS encrypts the whole message and Radius just the password, so I believe it won't work.
For your reference, I am sharing the link for the difference between TACACS and Radius.
http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml
Moreover, Please review the information as well.
Compare TACACS+ and RADIUS
These sections compare several features of TACACS+ and RADIUS.
UDP and TCP
RADIUS uses UDP while TACACS+ uses TCP. TCP offers several advantages over UDP. TCP offers a connection-oriented transport, while UDP offers best-effort delivery. RADIUS requires additional programmable variables such as re-transmit attempts and time-outs to compensate for best-effort transport, but it lacks the level of built-in support that a
TCP transport offers:
TCP usage provides a separate acknowledgment that a request has been received, within (approximately) a network round-trip time (RTT), regardless of how loaded and slow the backend authentication mechanism (a TCP acknowledgment) might be.
TCP provides immediate indication of a crashed, or not running, server by a reset (RST). You can determine when a server crashes and returns to service if you use long-lived TCP connections. UDP cannot tell the difference between a server that is down, a slow server, and a non-existent server.
Using TCP keepalives, server crashes can be detected out-of-band with actual requests. Connections to multiple servers can be maintained simultaneously, and you only need to send messages to the ones that are known to be up and running.
TCP is more scalable and adapts to growing, as well as congested, networks.
Packet Encryption
RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party.
TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. Within the header is a field that indicates whether the body is encrypted or not. For debugging purposes, it is useful to have the body of the packets unencrypted. However, during normal operation, the body of the packet is fully encrypted for more secure communications.
Authentication and Authorization
RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization.
TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After a NAS authenticates on a Kerberos server, it requests authorization information from a TACACS+ server without having to re-authenticate. The NAS informs the TACACS+ server that it has successfully authenticated on a Kerberos server, and the server then provides authorization information.
During a session, if additional authorization checking is needed, the access server checks with a TACACS+ server to determine if the user is granted permission to use a particular command. This provides greater control over the commands that can be executed on the access server while decoupling from the authentication mechanism.
Multiprotocol Support
RADIUS does not support these protocols:
AppleTalk Remote Access (ARA) protocol
NetBIOS Frame Protocol Control protocol
Novell Asynchronous Services Interface (NASI)
X.25 PAD connection
TACACS+ offers multiprotocol support.
Router Management
RADIUS does not allow users to control which commands can be executed on a router and which cannot. Therefore, RADIUS is not as useful for router management or as flexible for terminal services.
TACACS+ provides two methods to control the authorization of router commands on a per-user or per-group basis. The first method is to assign privilege levels to commands and have the router verify with the TACACS+ server whether or not the user is authorized at the specified privilege level. The second method is to explicitly specify in the TACACS+ server, on a per-user or per-group basis, the commands that are allowed.
Interoperability
Due to various interpretations of the RADIUS Request for Comments (RFCs), compliance with the RADIUS RFCs does not guarantee interoperability. Even though several vendors implement RADIUS clients, this does not mean they are interoperable. Cisco implements most RADIUS attributes and consistently adds more. If customers use only the standard RADIUS attributes in their servers, they can interoperate between several vendors as long as these vendors implement the same attributes. However, many vendors implement extensions that are proprietary attributes. If a customer uses one of these vendor-specific extended attributes, interoperability is not possible.
Traffic
Due to the previously cited differences between TACACS+ and RADIUS, the amount of traffic generated between the client and server differs. These examples illustrate the traffic between the client and server for TACACS+ and RADIUS when used for router management with authentication, exec authorization, command authorization (which RADIUS cannot do), exec accounting, and command accounting (which RADIUS cannot do).

Guest Activity on Cisco ISE

Is it possible to monitor the web pages visited for a guest using cisco ISE?

Hi Gino,
Yes, you can use the Guest Activity option. The Guest Activity report provides details about the websites that guest users are visiting. You can use this report for security auditing purposes to demonstrate when guest users accessed the network and what they did on it.
This report is available at: Operations > Reports > Endpoints and Users > Guest Activity.
To use this report you must first:
•Enable the passed authentications logging category. Choose Administration > Logging > Logging Categories and select Passed authentications.
•Enable these options on the firewall used for guest traffic:
–Inspect HTTP traffic and send data to Cisco ISE Monitoring node. Cisco ISE only requires the the IP address and accessed URL for the Guest Activity report so, if possible, limit the data to include just this information.
–Send syslogs to Cisco ISE Monitoring node
Please check the below link for further information,
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_guest_pol.html#wp1056645

Cisco ISE - dot1x behavior after returning from sleep mode

Hi,
In ISE deployment, When machine return from sleep mode , it do re-authentication process.
Is it possible to restore the same session?
if not ,Is it possible to let the authentication to re-run but making NAC agent not run or run in background?

similar discussions here
https://supportforums.cisco.com/discussion/11686306/reauthentication-problem-endpoints-using-cisco-ise-11

Cisco ISE CWA issue

Good Day,
I have Cisco ISE 1.2 with Cisco 2960 NAD.
I configured the authorization for the employee successfully, but my issue is with the guest users the link is not redirected.
Please advise what I have put in the authentication policy default rule?? deny access ?
And on the switch I should put the guest connect to a specific ports or I have to configure specific VLAN in the authorization profile?
Appreciate your support,

In your authorization policy you are giving your Wired-Guest the same result as Wired-Webauth.
First time through you don't know he's a guest so he hits Wired-Webauth and gets redirected. Second time through, you have him in guest flow, so you know he's an authenticated guest, he hits Wired-Guest, but you send him the same permissions "Web_Auth". Create a profile that you want to give to your authenticated guests - Guest_Allowed for instance.

Cisco ISE Guest Portal - DNS Issue - External Zone

Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

CWA using Cisco ISE issue

Similar Messages

Maybe you are looking for