Do I need Cisco ISE VM Part # L-ISE-VM-K9= for ESXi installation

Hi there,
Do I need the L-ISE-VM-K9 license to install Cisco ISE on an ESXi ?
Actually, Cisco ISE can be downloaded with an Eval License for 90 days.
I know, ISE license (e.g. Base License) is needed.
Thanks a lot.
Greetings,
Norbert

Just in case you you would like to see the specification of each licence.
License Type
Features Supported
Deployment Type Supported
License Prerequisite
License Term(s)
Base License
AAA
Guest Provisioning
Link Encryption Policies
Wired
Wireless
VPN
Perpetual
Advanced License
Device Onboarding/Provisioning
Device Profiling and Feed Service*
Host Posture
Security Group Access
Integrated Vendor MDM Support*
Wired
Wireless
VPN
Base License
3- and 5-Year Terms
Wireless License
Device Onboarding/Provisioning
AAA
Guest Provisioning
Link Encryption Policies
Device Profiling and Feed Service*
Host Posture
Security Group Access
Integrated Vendor MDM Support*
Wireless
3- and 5-Year Terms
Wireless Upgrade License
Device Onboarding/Provisioning
Authentication/Authorization
Guest Provisioning
Link Encryption Policies
Device Profiling
Host Posture
Security Group Access
Wired
Wireless
VPN
Wireless License
3- and 5-Year Terms
Cisco ISE Functionality-Based License Options
License Tiers (T)
Number of Endpoints Supported
Base License
Advanced 3-Year License
Advanced 5-Year License
Wireless 3-Year License
Wireless 5-Year License
Wireless Upgrade 3-Year License
Wireless Upgrade 5-Year License
100
100 Endpoints
L-ISE-BSE-100=
L-ISE-ADV3Y-100=
L-ISE-ADV5Y-100=
L-ISE-AD3Y-W-100=
L-ISE-AD5Y-W-100=
L-ISE-W-3UPG-100=
L-ISE-W-UPG-100=
250
250 Endpoints
L-ISE-BSE-250-
L-ISE-ADV3Y-250=
L-ISE-ADV5Y-250=
L-ISE-AD3Y-W-250=
L-ISE-AD5Y-W-250=
L-ISE-W-3UPG-250=
L-ISE-W-UPG-250=
500
500 Endpoints
L-ISE-BSE-500=
L-ISE-ADV3Y-500=
L-ISE-ADV5Y-500=
L-ISE-AD3Y-W-500=
L-ISE-AD5Y-W-500=
L-ISE-W-3UPG-500=
L-ISE-W-UPG-500=
1000
1000 Endpoints
L-ISE-BSE-1K=
L-ISE-ADV3Y-1K=
L-ISE-ADV5Y-1K=
L-ISE-AD3Y-W-1K=
L-ISE-AD5Y-W-1K=
L-ISE-W-3UPG-1K=
L-ISE-W-UPG-1K=
1500
1500 Endpoints
L-ISE-BSE-1500=
L-ISE-ADV3Y-1500=
L-ISE-ADV5Y-1500=
L-ISE-AD3Y-W-1500=
L-ISE-AD5Y-W-1500=
L-ISE-W-3UPG-1500=
L-ISE-W-UPG-1500=
2500
2500 Endpoints
L-ISE-BSE-2500=
L-ISE-ADV3Y-2500=
L-ISE-ADV5Y-2500=
L-ISE-AD3Y-W-2500=
L-ISE-AD5Y-W-2500=
L-ISE-W-3UPG-2500=
L-ISE-W-UPG-2500=
3500
3500 Endpoints
L-ISE-BSE-3500=
L-ISE-ADV3Y-3500=
L-ISE-ADV5Y-3500=
L-ISE-AD3Y-W-3500=
L-ISE-AD5Y-W-3500=
L-ISE-W-3UPG-3500=
L-ISE-W-UPG-3500=
5000
5000 Endpoints
L-ISE-BSE-5K=
L-ISE-ADV3Y-5K=
L-ISE-ADV5Y-5K=
L-ISE-AD3Y-W-5K=
L-ISE-AD5Y-W-5K=
L-ISE-W-3UPG-5K=
L-ISE-W-UPG-5K=
10,000
10K Endpoints
L-ISE-BSE-10K=
L-ISE-ADV3Y-10K=
L-ISE-ADV5Y-10K=
L-ISE-AD3Y-W-10K=
L-ISE-AD5Y-W-10K=
L-ISE-W-3UPG-10K=
L-ISE-W-UPG-10K=
25,000
25K Endpoints
L-ISE-BSE-25K=
L-ISE-ADV3Y-25K=
L-ISE-ADV5Y-25K=
L-ISE-AD3Y-W-25K=
L-ISE-AD5Y-W-25K=
L-ISE-W-3UPG-25K=
L-ISE-W-UPG-25K=
50,000
50K Endpoints
L-ISE-BSE-50K=
L-ISE-ADV3Y-50K=
L-ISE-ADV5Y-50K=
L-ISE-AD3Y-W-50K=
L-ISE-AD5Y-W-50K=
L-ISE-W-3UPG-50K=
L-ISE-W-UPG-50K=
100,000
100K Endpoints
L-ISE-BSE-100K=
L-ISE-ADV3Y-100K=
L-ISE-ADV5Y-100K=
L-ISE-AD3Y-W-100K=
L-ISE-AD5Y-W-100K=
L-ISE-W-3UPG-100K=
L-ISE-W-UPG-100K=
Cisco ISE Functionality-Based License Options
License Type
License SKU
Base License
L-ISE-BSE-[T]=
Advanced 3-Year License
L-ISE-ADV3Y-[T]=
Advanced 5-Year License
L-ISE-ADV5Y-[T]=
3-Year Wireless License
L-ISE-AD3Y-W-[T]=
5-Year Wireless License
L-ISE-AD5Y-W-[T]=
3-Year Wireless Upgrade License
L-ISE-W-3UPG-[T]=
5-Year Wireless Upgrade License
L-ISE-W-UPG-[T]=
Replace [T] with the appropriate license tier from Table 5 and 6.
Jatin Katyal
- Do rate helpful posts -

Similar Messages

  • Need Cisco ISE Configuration Guide

    Dear Friends,
    Please send me cisco ISE configuration guide ASAP.
    Thanks & Regards,
    Rahul Wankhade

    Check the following link for Step by step configuration guide it cover all the deployment related to ISE
    http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html
    ************Do rate helpful posts**********************

  • Cisco ISE and authentication for 802.1x printer

    Hello
    What is the best practice to authenticate a 802.1x printer in Cisco ISE?
    The printer can store a certificate for authentication and support EAP-TLS.
    Thanks for answer.
    Marco

    EAP-TLS is the way to go. It is way way way more secure than MAB and profiling. However, the question is "How much of a hassle is it going to be to put a certificate on each printer?" Moreover, "What methods do I have (if any) to renew those certificates when they expire?" If have to manually generate a CSR and install a cert on each printer then it can quickly become an administrative overhead nightmare. With that being said, you can use MAB and profiling but just make sure that you lock down the access that those printers get. For instance, do they need access to the internet? Do they need access to anything else but the print server and/or open to all IPs access but only on the printing ports. 
    I hope this puts you in the right direction!
    Thank you for rating helpful posts!

  • Cisco ISE posture check for VPN

    Hello community,
    first of all thank you for taking time reading my post. I have a deployment in which requires the feature posture checks on VPN machines from Cisco ISE. I know logically once a machine is in the LAN, Cisco ISE can detect it and enforce posture checks on clients with the Anyconnect agent but how about VPN machines? The VPN will be terminated via a VPN concentrator which then connects to an ASA5555X which is deployed as an IPS only. Are there any clues to this? 
    Thank you!

    The Cisco ASA Version 9.2.1 supports RADIUS Change of Authorization (CoA) (RFC 5176). This allows for posturing of VPN users against the Cisco ISE without the need for an IPN. After a VPN user logs in, the ASA redirects web traffic to the ISE, where the user is provisioned with a Network Admission Control (NAC) Agent or Web Agent. The agent performs specific checks on the user machine in order to determine its compliance against a configured set of posture rules, such as Operating System (OS), patches, AntiVirus, Service, Application, or Registry rules.
    The results of the posture validation are then sent to the ISE. If the machine is deemed complaint, then the ISE can send a RADIUS CoA to the ASA with the new set of authorization policies. After successful posture validation and CoA, the user is allowed access to the internal resources.
    http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117693-configure-ASA-00.html

  • Did Cisco ISE have limitation for policy setting?

    Deat All,
    Did anyone know about Cisco ISE limitation about policy setting?
    Right now my setting for windows posture policy around 200 windows patch checking, did ISE have limitation such as maximum windows patching policy line?
    Thanks you
    Best Regards

    Here is the nswer for your first question.
    Cisco ISE profiler collects a significant amount of endpoint data from the network in a short period of time. It causes Java Virtual Machine (JVM) memory utilization to go up due to accumulated backlog when some of the slower Cisco ISE components process the data generated by the profiler, which results in performance degradation and stability issues.
    To ensure that the profiler does not increase the JVM memory utilization and prevent JVM to go out of memory and restart, limits are applied to the following internal components of the profiler:
    Endpoint Cache—Internal cache is limited in size that has to be purged periodically (based on least recently used strategy) when the size exceeds the limit.
    Forwarder—The main ingress queue of endpoint information collected by the profiler.
    Event Handler—An internal queue that disconnects a fast component, which feeds data to a slower processing component (typically related to a database query).
    For more information go through :
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_prof_pol.html#12624

  • Cisco ISE authentication failed for Win XP SP3

    Hello,
    I have some trouble this Win XP wired Client authentication. With Win7 everything works well.
    ISE 1.2 (patch 4)
    Switch: 2960 / 2960S (15.0.(2)SE2)
    Authentication details:
    Event:
    5400 Authentication failed:
    Failure Reason
    11514 Unexpectedly received empty TLS message; treating as a rejection by the client
    Resolution
    Ensure that the client's supplicant does not have any known compatibility issues and that it is properly configured. Also ensure that the ISE server certificate is trusted by the client, by configuring the supplicant with the CA certificate that signed the ISE server certificate. It is strongly recommended to not disable the server certificate validation on the client!
    Root cause While trying to negotiate a TLS handshake with the client, ISE expected to receive a non-empty TLS message or TLS alert message, but instead received an empty TLS message. This could be due to an inconformity in the implementation of the protocol between ISE and the supplicant. For example, it is a known issue that the XP supplicant sends an empty TLS message instead of a non-empty TLS alert message. It might also involve the supplicant not trusting the ISE server certificate for some reason. ISE treated the unexpected message as a sign that the client rejected the tunnel establishment.
    I try to disable validate server certificates on Win XP Clients, but it won´t work for me.
    Add ISE self-sign certificate to clients trusted root certification authorities and enable validate server certificates also won´t work.
    Any idea?
    thanks

    The ISE use a self-signed certificate. I add this self-signed certificate to the clients "trusted root certification authorities", enable validate server certificates at the eap properties and select the added certificate from the trust list. But if I uncheck validate server certificates, I see the same error message as well.
    Are there any differences between xp client config and win7 client config?
    thanks,

  • Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

    With Eric Yu and Todd Pula 
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions  about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
    Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE). 
    Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
    Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.   
    Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
    Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
    Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

    Hi Antonio,
    Many great questions to start this series.  For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent?  Does the problem happen for one WLAN but not another?  As it stands today, the CoA-Ack needs to be initiated by the management interface.  This limitation is documented in bug CSCuj42870.  I have provided a link for your reference below.  If the problem happens 100% of the time, the two configuration areas that I would check first include:
    On the WLC, navigate to Security > RADIUS > Authentication.  Click on the server index number for the associated ISE node.  On the edit screen, verify that the Support for RFC 3576 option is enabled.
    On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question.  On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked.  When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface.  Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface.  As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
    Bug Info:  https://tools.cisco.com/bugsearch/bug/CSCuj42870
    For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request.  We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered.  Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers.  For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
    As for product roadmap questions, we won't be able to discuss this here due to NDA.  Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
    Related Info:
    Wireless BYOD for FlexConnect Deployment Guide

  • Cisco ip phones authenticate 802.1x with cisco ise 1.3

    Dear all,
    I want to configure cisco ise 1.3 with 802.1x , to authenticate cisco ip phones ( CUCM 10.5.2 ) with LSC certificate. 
    How I have to configure cisco ise authentication rules for 802.1x with cisco ip phones? Are there any configuration examples ? 
    Thanks

    following are ISE 802.1x  sample authentication rules..you can change the protocol (Policy -> policy elements - > results -> authentication and you can select the proctocal)

  • Cisco works and cisco ISE

    The question is whether Ciscworks 3.1 or version 4.0 supports Cisco ISE as integration for authentication

    Hi,
    Nope its not supported.
    Thanks,
    Gaganjeet

  • Trying to load Balance several Cisco ISE servers.

    Trying to load Balance several Cisco ISE servers.  For persistence, Cisco recommends using Calling-Station-ID and Framed-IP-address...Session-ID is recommended if load balancer is capable of it.  I have documentation for the Cisco ACE, but using F5 LTM's.  Assuming this has to be done with an I-Rule as none of these are available as a default.  Not sue where to begin.  I tried attaching the Cisco PDF, but not able for whatever reason.

    Please also keep in mind that When using a Load-Balancer (anyone's) you must ensure a few things.
    Each PSN must be reachable by the      PAN /  MNT directly, without having to go through NAT (Routed mode LB,       not NAT). No Source-NAT. This includes the Accounting      messages, not  just the Authentication ones.
    This means the       Load-Balancer must be in the direct path between the clients and the ISE PSNs.
    Some       organizations have used Policy  Based Routing (PBR) to accomplish the       path, without physically  locating the Load-Balancer between the clients       and the PSNs.
    Endpoints (clients) must be able      to  reach each Policy Services Node Directly (not going through the VIP) for       redirections/Centralized Web Authentication/Posture  Assessments/Native      Supplicant Provisioning, and more.
    You may want to "hack"      the certs to include the VIP FQDN in the SAN field (my next blog post      should cover this trick).
    Perform sticky (aka: persistence)      based on Calling-Station-ID and Framed-IP-address.
    VIP gets listed as the RADIUS      server of each NAD for all 802.1X related AAA.
    Dynamic-Authorization (CoA):
    If you use       Server NAT to replace the  PSN IP address with the VIP Address for Change       of Authorization,  then you would use the VIP address as the       Dynamic-Authorization  (CoA) client.
    Otherwise, use       the real IP Address of the PSN, not the VIP.
    The LoadBalancers get listed as      NADs in ISE so their test authentications may be answered, to keep the      probes alive.
    ISE uses the Layer-3 Address      to  identify the NAD, not the NAS-IP-Address in the RADIUS packet. This       is a big reason to avoid SNAT.
    Failure Scenarios:
    The VIP is the RADIUS Server, so      if the  entire VIP is down, then the NAD should fail over to the Secondary       DataCenter VIP (listed as the secondary RADIUS server on the NAD).
    Use probes on the Load-Balancers      to ensure that RADIUS is responding, as well as HTTPS (at minimum).
    LB Probes       should send test RADIUS  messages to each PSE periodically, to ensure that       RADIUS is  responding, not just look for open UDP ports.
    LB Probe should       also examine the response for HTTPS, not just look for the open port(s).
    Use node-groups with the L2-adjacent      PSN's behind the VIP.
    If the       session was in process and one  of the PSN's in a node-group fails,       then another member of the  node-group will issue a CoA-reauth; forcing       the session to begin  again. 
    At this point,       the LB should have  failed the dead PSN due to the probes configured       in the LB; and so  this new authentication request will reach the LB &       be  directed to a different PSN…

  • Cisco ISE syslog

    Hello,
    From what I understand Cisco ISE has LogCollector for SysLog.
    I have configured a switch to send syslog:
    logging monitor informational
    logging origin-id ip
    logging source-interface <interface_id >
    logging host <syslog_server_IP_address_x > transport udp port 20514
    ,but I am unable to find syslog messages generated by switch.
    Can I view syslog messages in ISE ? , or are there just for ISE to use in the background ?
    Regards,
    Bogdan

    You should post your question on the AAA forum
    https://supportforums.cisco.com/community/netpro/security/aaa
    Thanks,
    Scott
    Help out other by using the rating system and marking answered questions as "Answered"

  • Cisco ISE Profling BYOD

    What happens with devices that are not in the list of Cisco ISE profiling?
    For example I have android Alcatel devices and are not recognized.
    I have just the ISE solution implemented without MDM and I have to add the device manually, is there any way to create a profiling for all devices of a specific brand?
    I updated the profiling frequently but the problem persists.

    Duplicate post, go here

  • Need Step by step installation guide for Cisco ISE in distributed environment.

                 Hi Friends,
    If anyone is having  step by step installation guide for Cisco ISE in distributed environment please shere!
    I have user guide from Cisco, but does someone have created at the time of actual installation.
    Thanks,
    Sachin

    There is a trustsec 2.1 how to guide on cisco's website. There is also a TrustSec 2.0 ISE Guide floating around that has step by step instructions for setting up ISE 1.0.4. Which is still pretty accurate for the 1.1.1 guide. But if you go through the below site it should give you all the info you need.
    http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html

  • AD Machine Authentication with Cisco ISE problem

    Hi Experts,
    I am new with ISE, I have configured ISE & Domain computers for PEAP authentication. initially machine gets authenticated and then starts going MAB.
    Authentication policy:
    Allowed protocol = PEAP & TLS
    Authorization Policy:
    Condition for computer to be checked in external identity store (AD) = Permit access
    Condition for users to be checked in external identity store (AD) plus WasMachineAuthenticated = permit access
    All of the above policies do match and download the ACL from ISE but computer starts to mab authentication again...
    Switchport configuration:
    ===============================================
    ip access-list extended ACL-DEFAULT
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    permit ip any host (AD)
    permit icmp any any
    permit ip any host (ISE-1)
    permit ip any host  (ISE-2)
    permit udp any host (CUCM-1) eq tftp
    permit udp any host (CUCM-2)eq tftp
    deny ip any any
    ===============================================
    switchport config
    ===============================================
    Switchport Access vlan 10
    switchport mode access
    switchport voice vlan 20
    ip access-group ACL-DEFAULT in
    authentication open
    authentication event fail action next-method
    authentication event server dead action authorize vlan 1
    authentication event server alive action reinitialize
    authentication host-mode multi-domain
    authentication order dot1x mab
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    authentication timer inactivity 180
    authentication violation restrict
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 100
    ====================================================
    One more problem about the "authentication open" and default ACL. Once the authentication succeeds and per user is ACL pushed though ISE to the switch. The default ACL still blocks communication on this switchprort.
    Your help will highly appreciated.
    Regards,

    You need to watch the switch during an authentication, see if the machine is passing authentication and the user may be failing authentication causing the switch to fail to mab.  If your switch configuration is on auth failure continue to next method, then this makes sense.  The question is why is the user failing auth but the machine is passing, could be something in the policy.  Make sure your AD setup has machine authentciation checked or it may not tie the machine and user auth together and the user may be failing because ISE can't make that relationship so the machinewasauth=true is not beeing matched.  Easy way to check is remove that rule from your policy and see if the same thing happens.
    I've also seen this happen when clients want to use EAP-TLS on the wired, machines passes auth, then the user logs into a machine for the first time.  The user auth kicks off before the user gets a cert and fails auth with a null certificate, since this is a auth failure the switchport kicks over to MAB.
    I don't think wasmachineauth=true is that great, I prefer to use EAP-FASTv2 using Cisco Anyconnect NAM with eap-chaining.  This is great because you can do two part authentication.  EAP-FAST outer with EAP-TLS inner for the machine auth, and MSCHAPv2 for the inner of the user auth. You get your EAP-TLS auth for the machine and don't have to worry about a user logging into a machine for the first time and switching to MAB because the user doesn't have a cert yet.  I also do my rule to say if machine pass and user fail, then workstaion policy, if machine and user pass then corp policy.

  • Cisco ISE configs for switch

    I suppose Cisco ISE sends a URL redirect to the switch and the switch presents it to the client in case of guest Access getting a URL redirect with User Acceptance Page (Wired Guests and not wireless).
    My question here is, Do we need to configure http and https server on the switches (both supplicant and authenticator)?
    I am sure it will need but just wanted a confirmation..
    I have checked the configuration for supplicant and Authenticator switches for ISE and it has no where mentioned that part of the config.
    http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_troubleshooting.html (a problem of URL redirection and possible cause is mentioned) ------- makes me sure that the config is needed.
    http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_010000.html
    (config of supplicant and authenticator switch)---- nowhere mentioned of the http/https config for both switches.

    Yes, its needed.  The http/s server within the swtich is used to grab the http user traffic and redirect the traffic to the CWA portal, or a device registration portal, or even to the Mobile Device Management (MDM) onboarding portal.  .
    ip http server
    ip http secure-server
    The info below I grabbed from Cisco ISE for BYOD and secure unified access book.
    "Many organization want to ensure that this redirection process using the switch's internal HTTP server is decoupled from the management of the switch itself, in order to limit the chances of an end user interacting with the management intervace and control plane of a switch.  this may be accomplished by running the following two commands from global configuration mode:
    ip http active-session-modules none
    ip http secure-active-session-modules none"

Maybe you are looking for

  • Handled http connection exceptions works fine on emualtor but bot on phone?

    I have written some code to do a currency conversion. The code works fine when a proper url is entered: http://finance.yahoo.com/currency/convert?amt=1150& from=GBP& to=JPY& submit=Convert I wanted to see how the error handling worket so i entered a

  • DB Link Error !!!!!!!

    LKM Oracle to Oracle DB link - Error ( Jan 5 2009) It worked fine on the same day when it got some inputs frm this forum... !! Hi , My Source and Target databases are Oracle... Since my Source has around 2 million records.....it is taking too much of

  • Transaction FMN5N - but impossible to create PO with solved Earmarked Fund

    Hello, The display consumption history of Eamarked funds shows an open amount of 58 819, 07 but Transaction FMRP_RFFMEP1OX withthe filter criteria doc. No.1200000197 shows an open amount of 15 965,18 (Amount type 0100 (58 819,07) and Amount type 0200

  • Install Oracle8 client in silent mode under windows environment

    I would like to know how can i install Oracle8 client in silent mode under windows environment. I would appreciate a prompt reply on this

  • Business Objects - Discoverer

    Hi Folks, I have a customer with a number of business objects universe (V4) at a number of different sites. Is there any toolkits and/or white papers which can help to grease the transition to Discoverer. Many Thanks, Barry null