Ise 1.2.0.899 CWA Windows AD based

Hi, I'm running ISE 1.2.0.899 patch 6
When a use a internal ISE user which in the Identity Group "Onboard". The guest authentication, self registration and profiling are going just great (see picture) . But when I use a AD created user which on AD is in the same "Onboard" security group, it is authenticated but further than that I got the message" The system admin has either not configured or enabled a policy for your device". Furthermore I can see in the log that the AD user is authenticatd with Identity Group "Any". I tried several things in the authorization in matching the memberof/ external group based on "Onboard" with or without the guest flow specified. If I manage to get the device to registered in the Identity Endpoint and I try to match on a AD group I see that is working.
So to bottom line of this question is; if the BYOD/CYOD is not registered in the ISE ( Identity Endpoint) which policy rule can I make so it will profile it as a android and put it as a registered device?
Does anyone know how this can be configured? Any help is appreciated.
Thanks in advance,
Kind regards,
Michel

Hi Neno,
I was mislead by the d0t1x AuthN in my first statement, if a connection is made on d0t1x with PEAP (mschapv2) then the AuthN check in the identity source sequence (first AD ) if the user exist. This is the case so this connection is allowed by AuthZ rule: BYOD_AD_D0t1x
1. What do you have configured under: Administration > System > Settings > Profiling > CoA?
currently it is configured for: "no COA"
as the cisco documentation said:
Exemptions for Issuing a Change of Authorization:
An Endpoint Created through Guest Device Registration flow—When endpoints are created through device registration for the guests. Even though CoA is enabled globally in Cisco ISE, the profiling service does not issue a CoA so that the device registration flow is not affected. In particular, the PortBounce CoA global configuration breaks the flow of the connecting endpoint.

Similar Messages

ISE 1.2.0.899 patch 1,2,3,4 with blackberry 9700

Hi, I'm using ISE 1.2.0.899 patch 1,2,3,4, and I am trying to use guest portal on blackberry 9700.
I verified that I am able to do 802.1x with blackberry.
I associated to ssid, and opened web browser, and I can see the guest portal.
However, when I clicked on "don't have account?" to creating guest ID, I could not go any further.
does anyone know if it's supported or not ? if it's working or not ?
I know in the network compatibility document for 1.2, there is no mention about blackberry.
does anyone know about this ?

Saurav Lodh, I did check the default time profile that is being used the sponsor. I even created a custom time profile to rule out any timeout on the Guest account, but even with the custom profile time the Guest account times out between 7 to 10 minutes and asks to re-authenticate again. I don't know if there is another place to look out for any timeouts, or is it maybe a bug with this version of ISE, but I couldn't find anybody else having this same issue which makes me think that it has to be a setting that is causing this problem.

ISE 1.2.0.899 Patch 7

Hey guys I have ISE 1.2.0.899 with patch 7 installed in my environment, also I have a WLC 5508 running version 7.4.121.0. We are authenticating our user with ISE. We are having an issue with our Guest WLAN, after we create an account with the sponsor portal for our guests, they can log in and get to the internet, but after 7 to 10 minutes the guest user is ask to re-authenticate again. I check in the WLC to see if there is any timeout for our Guest WLAN, but there not. At this point we don't know what is causing this problem since it only happens with the Guest WLAN, the other WLAN for Users that authenticate with AD credentials works without any problems. Is anybody experiencing this same issue?

Saurav Lodh, I did check the default time profile that is being used the sponsor. I even created a custom time profile to rule out any timeout on the Guest account, but even with the custom profile time the Guest account times out between 7 to 10 minutes and asks to re-authenticate again. I don't know if there is another place to look out for any timeouts, or is it maybe a bug with this version of ISE, but I couldn't find anybody else having this same issue which makes me think that it has to be a setting that is causing this problem.

Help with cisco ISE 1.1.2.145 patch-3 to ISE 1.2.0.899-2-85601 upgrade procedure

Need help from ISE experts/gurus in this forum.
Due to a nasty bug in Cisco ISE (bug ID CSCue38827 ISE Adclient daemon not initializing on leave/join), this bug will make the ISE stopping working completely and a reboot is required (very nice bug from cisco) . This leaves me no choice but to upgrade to version 1.2.0.899-2-85601.
Scenario:
- 4 nodes in the environment running ISE version 1.1.2.145 patch 3
- node 1 is Primary Admin and Secondary Monitoring - hostname is node1
- node 2 is Secondary Admin and Primary Monitoring - hostname is node2
- node 3 is Policy service node - hostname is node3
- node 4 is Policy service node - hostname is node4
Objective: Upgrade the ISE environment to ISE version 1.2 with patch version 1.2.0.899-2-85601.
My understand is that I have to upgrade the existing environment from ISE version 1.1.2.145 patch 3
to ISE version 1.1.2.145 patch 10 (patch 10 was released on 10/04/2013) before I can proceed with
upgrading to ISE version 1.2 and patch it with 1.2.0.899-2-85601.
Can I patch my exsiting environment from 1.1.2 patch 3 to patch 10 prior to upgrading to version 1.2.0.899-2-85601?
I look at Cisco website and patch 10 was released on 10/04/2013 while version 1.2 was released back in 07/05/2013.
I am trying to get a definite answer from Cisco TAC but it seems like they don't know either.
Question #1: How do I proceed with upgrading the current ISE environment from 1.1.2.145 patch 3 to 1.1.2.145 patch 10?
Propose solution:
step #1: make ISE node1 to be both Primary Admin and Primary monitoring. ISE node2 is now Secondary Admin and Secondary Monitoring.
         Then go ahead and apply ISE version 1.1.2.145 patch 10 to ISE node2 via the GUI,
step #2: Once ISE node2 patch 10 is completed, make node2 Primary Admin and Primary Monitoring. At this point, apply ISE 1.1.2.145 patch 10
         to ISE node1 via the GUI,
step #3: Once ISE node1 patch 10 is completed, make node1 Primary Admin and Secondary Monitoring and node2 Secondary Admin and Primary Monitoring,
step #4: apply ISE 1.1.2.145 patch 10 to ISE Policy Service node3. Once that is completed, verify that node2 is working and accepting traffics,
step #5: apply ISE 1.1.2.145 patch 10 to ISE Policy Service node4. Once that is completed, verify that node2 is working and accepting traffics,
Question #2: How do I proceed with upgrading the current ISE environment from 1.1.2.145 patch 10 to ISE version 1.2 with patch version 1.2.0.899-2-85601?
Propose solution:
step #1: Make ISE node1 the Primary Admin and Primary monitoring. At this point ISE node2 will become Secondary Admin and Secondary Monitoring
step #2: Perform upgrade on the ISE node2 via the command line "application upgrade <app-bundle> <repository>". Once ISE node2 upgrade is completed, it will
          form a new ISE 1.2 cluster independent of the old cluster,
step #3: Perform upgrade on the ISE Policy Service node3 via the command line "application upgrade <app-bundle> <repository>". After the upgrade the ISE
          Policy Service Node3 will automatically joins the ISE node2 which is already in version 1.2
step #4: Perform upgrade on the ISE Policy Service node4 via the command line "application upgrade <app-bundle> <repository>". After the upgrade the ISE
          Policy Service Node4 will automatically joins the ISE node2 which is already in version 1.2
step #5: At this point the only node remaining in the 1.1.2.145 patch 10 is the ISE node1 Primary Admin and Primary Monitoring
step #6: Check and see if there are any more PSN's registered in ISE node1 (there should not be any)
step #7: Perform the upgrade on the ISE node1 from command line "application upgrade <app-bundle> <repository>"
step #8: Once upgrade on ISE node1 is complete, ISE node1 will automatically join the new ISE 1.2 cluster,
step #9: Make ISE node1 Primary Admin and Secondary and ISE node2 Secondary Admin and Primary Monitoring,
Question #3: How do I proceed with upgrading the current ISE environment from 1.2 patch0 to 1.2.0.899-2-85601?
Propose solution:
step #1: make ISE node1 to be both Primary Admin and Primary monitoring. ISE node2 is now Secondary Admin and Secondary Monitoring.
         Then go ahead and apply ISE 1.2.0.899-2-85601 to ISE node2 via the GUI,
step #2: Once ISE node2 1.2.0.899-2-85601 is completed, make node2 Primary Admin and Primary Monitoring. At this point, apply 1.2.0.899-2-85601
         to ISE node1 via the GUI,
step #3: Once ISE node1 patch 10 is completed, make node1 Primary Admin and Secondary Monitoring and node2 Secondary Admin and Primary Monitoring,
step #4: apply ISE 1.2.0.899-2-85601 to ISE Policy Service node3. Once that is completed, verify that node2 is working and accepting traffics,
step #5: apply ISE 1.2.0.899-2-85601 to ISE Policy Service node4. Once that is completed, verify that node2 is working and accepting traffics,
does these steps make sense to you?
Thanks in advance.

David,
A few answers to your questions -
Question 1: My recommendation is to follow vivek's blog since most fixes and upgrade steps are provided there - I would recommend installing the patch that was release prior to the 1.2 release date since the directions to "install the latest patch" would put you at the version of when the ISE 1.2 was released
https://supportforums.cisco.com/community/netpro/security/aaa/blog/2013/07/19/upgrading-to-identity-services-engine-ise-12
You do not have the ability to install ISE patch through the GUI on any of the "non-primary" nodes (you can use the cli commmand to achieve this), the current patching process was designed so you can install the patch on the primary admin node and it will then roll the patches out to the entire deployment (one node at at time). I painfully verified this by watching the services on each node and when a node was up and operational the next node would start the patching process. First the admin nodes then the PSNs.
Every ISE upgrade that I have attempted as not been flawless and I can assure you that I have done an upgrade on 1.1.2 patch 3 and this worked fine, however I used the following process. You will need the service account information that is used to join your ISE to AD.
I picked the secondary admin/monitoring node and made it a standalone node by deregistering (much like the old procedure) in your case this will be node2.
I backed up the certificates from the UI and the database from the CLI (pick the local disk or ftp-your choice).
I reset the database and ran the upgrade script (since I did not have access to the vsphere console or at the location of the non UCS hardware [for a 1.1.4 upgrade]).
Once the upgrade was completed I then restored the 1.1.x database, ISE 1.2 now has the ability to detect the version of the database that is restored and will perform the migration for you.
Once the restore finished, I then restored the certificate and picked one of the PSNs
backup the cert,
Had the AD join user account handy
reset-db,
and run the upgrade script.
Once that is done I then restore the cert
Join the PSN to the new deployment
Join both nodes to AD through primary admin node
Monitor for a few days (seperate consoles to make sure everything runs smooth)
If anything doesnt look or feel right, you can shut down the 1.2 PSN and force everything through the existing 1.1.2 setup and perform some investigation, if it all goes smooth you can then follow the above step for the other two nodes, starting with the last PSN and the the last admin node.
Thanks and I hope that helps,
Tarik Admani
*Please rate helpful posts*

Applying Patches to ISE 1.2.0.899

I am running ISE 1.2.0.899 Patch level 2.
I want to upgrade to patch level 6.
I understand that the ptaches are supposed to be cumulative and not incremental...but I want to make sure as I am 4 levels behind...Is there anything special I have to do? Do I just apply patch 6 from the Primary Admin node and it brings me straight to patch 6?
Didn't note anything in the release notes, but I don't want to run into any surprises.
Thanks,
Phill

Well,
I upgraded to patch 6. The patch did not replicate over to the other two nodes as I expected.
I called TAC and was told to accomplish this manually, which I did on the secondary node.
I did not have FTP access to the one in my DMZ, so I had to put that one off until the evening (had to get the firewall guy to give me access...then wait until after production hours). Anyhow, we noted a large increase in traffic between the primary ISE node and the Policy Service node in our DMZ...traffic flow seemed to be around 40 megs. This flow ceased when I manually upgraded the DMZ Policy Service Node.

TS1369 Hello! I have an Ipod Shuffle 2nd Generation and it is not recognized by my Windows 8 based laptop. An error message of 'USB device not recognized' is shown. I have the latest ITunes version installed, and tested the dock in other pc's.

Hello!
I have a problem connecting my Ipod Shuffle 2nd generation to my Windows 8 based laptop. The computer doesn't recognize the Ipod and issues an error message saying 'USB device not recognized'. I tried uninstaling ITunes(latest version) and all other Apple software and reinstaling it back again, checked my USB hubs in the 'Device Manager' section of the Control Panel, you name it.
I could really use some help solving this.
I've turned to the troubleshooting section in Apple Support but it has nothing concerning situations in wich the device isn't even shown in the 'My Computer' folder.
Help a brother out, will you???

Found a solution in another forum http://en.kioskea.net/forum/affich-63733-ipod-not-detected-on-computer (a few posts down).
It was for an IPOD so you can see those details in the link.
Found how to reset a shuffle and inserted it into these instructions - did not have to follow his last steps.
- Turn off computer.
- Plug Shuffle into usb.
- Then you must reset your shuffle
To reset iPod shuffle:
Disconnect iPod shuffle from the computer (if connected).
Move the switch on the iPod shuffle to the OFF position. Note that when iPod shuffle is off, the green stripe by the switch is not visible
Disconnect iPod shuffle from the computer (if connected).
Move the switch on the iPod shuffle to the OFF position. Note that when iPod shuffle is off, the green stripe by the switch is not visible.
- Start computer and it should install the usb driver for the ipod automatically.
- Your i pod will say do not unplug so don't. then open itunes and it will be there.
I did not have to do these thing below – did not get error message and shuffle was displayed in Itunes. / LMc
Just remember to not only eject ipod from itunes but stop usb.
Go to the program icons near the clock and right click the usb icon and "safely remove hardware" will appear and click it.
Stop it and select "apple ipod".

How can I install a 2605dn printer to ny network using a windows 7 based computer?

I have been running a 2605dn colour laser printer on my home network for some time now without trouble. The XP computer that I used to install the printer has died and I now have a windows 7 based machine.
The printer needs to be re-installed and the installation disk is for windows XP and 2000.
How can I install this printer without an XP based pc?

Get the latest software for your printer from the "Support & Drivers" link at the top of this page.
Say thanks by clicking "Kudos" "thumbs up" in the post that helped you.
I am employed by HP

Import Mail and Contacts, from Windows XP-based Thunderbird Email to New iPad Air

Just got a New iPad Air, and I want to import all of my email & contacts (email addresses) from a Windows XP-based Thunderbird Email program.
Does anyone know how to do this?
Thank you in advance!

Do you have all messages left on the server? Then you can simply set-up your Gmail account as IMAP account.
https://support.mozilla.org/en-US/kb/thunderbird-and-gmail<br>
https://support.google.com/mail/answer/78892
To import your contacts from Gmail you can use this add-on:<br>
https://addons.mozilla.org/en-us/thunderbird/addon/google-contacts/

I have Photoshop Elements 4.0. Can I use it on a windows Vista based computer

Q. I have Photoshop Elements 4.0. Can I use it on a windows Vista based computer.

Mac OS Extended is not an OS, it is how the drive is formatted. This format will not work with a PC. If you reformat (erase) the drive with a PC format, it will work with a PC.

Developing Java application for windows CE based Handheld device

Hi everybody,
I am planning to develop the java application for windows CE
based handheld device.I came to know that Oracle 9iLite supports
the Developement of Java Application for windows CE devices.Can
i use the JDeveloper IDE to develop the application on windows
NT.If so how to deploy the application on windows CE device(Is
there any options in Jdeveloper to deploy the application).Any
body please give the solution.
Regards,
Siva mani kumar.D

I agree. In my opinion Sun has done a horrible job documenting all this madness for the average developer just starting out with this stuff. There is the CLDC, J2ME, Personal Java, J2ME-WTK, MIDP, MIDP-FCS ... maddness. Anyway after sorting through it all for a few days, I think the answer to your question you will need to use Personal Java for WinCE and the Sharp Zaurus, and MIDP for PalmOS for the palm. Jeode seems to be the most common and best Personal Java implementation and it is basically the JDK1.2.2 (or is it 1.1.8) that is designed to run on WinCE and Embeddix (such as Lineo on the Zaurus). You program it just like you would a 1.1.8 application and then you can test it by running pjava.exe which is included in the personal java 3.1 download from Sun. There is also a program called JavaCheck that will ensure that your app will run properly in PersonalJava. As for the Palm, MIDP for PalmOS is a 574K program that installs on your palm device. You then use the J2ME-WTK (wireless toolkit) to build a JAR/JAD file and you use the MIDP API to write the code.

Problem connecting old Philips WIndows XP based Multimedia PC to AEBS

I upgraded my brother's wireless network by turning off the Wifi from his 'oldish' Linksys and attaching a AEBS in bridge mode to his linksys. This works fine for his imac and MacBook Pro, as well as his iPod and AE (used for AirPlay). The AEBS is set up to offer a separate network for the 2.4GHz and 5GHz bands. The channels are 'not wide'.
But one older system refuses to connect. It is an old Philips Windows XP based media center with a AR5006XS chipset based 802.11 b/g card. The log in the AEBS shows a constant failure to connect with errors "WPA handshake failed with STA".
Having looked around, I noticed some web pages with some info on problems with this chipset, no info specific to this Media Center PC. Does anybody have an idea what I could do best to get this system connected again? Drivers?
If updated XP drivers for this thing are not available, I was thinking to use an older M8799LL/A AEBS I have lying around here. I would then want to set that one up in bridge mode and let it join the existing network. I would then attach the ethernet to the Windows PC. Would that work with that base station?

Bob Timmons wrote:
The channels are 'not wide'.
If you are talking about 5 GHz, they need to be "wide" if you want maximum bandwidth on the network. I don't know why you would not want this, but you may have your reasons.
Though his house is made from wood his reception problems are much bigger than mine (and my house is made from concrete). I have made the channels narrow to minimize interference as a possible source of problems.
Having looked around, I noticed some web pages with some info on problems with this chipset, no info specific to this Media Center PC. Does anybody have an idea what I could do best to get this system connected again? Drivers?
Based on your description, and a guess, this sounds very much like the Media Center PC wants to connect using older WEP 128 or WEP 40 encryption. It probably cannot handle WPA authentication.
According to what Windows tells me I can select WPA and the log of the AEBS also shows me that an WPA attempt is being made. It just fails. It was also connecting with WPA succesfully to the linksys before I replaced the linksys' wireless with the AEBS. So it looks like a wifi compatibility problem between the driver on the XP machine and the AEBS.

Neurowm - dynamic tiling window manager based on Xmonad

Hi,
I started to write my own window manager last year so that it fits exactly my needs. The project was paused due to a lack of time but last month I could start coding again and make it stable. It was my very first step into the X protocol so I decided to use C language and Xlib rather than XCB because of the documentation. I might plan to port it to XCB in the near future though.
neurowm is a dynamic tiling window manager based on Xmonad, where you must write your own configuration using C language instead of Haskell language. If you are familiar with Xmonad, you should be able to understand the configuration easily.
Some features:
- Compile and reload the comfiguration file on the fly withour restarting X
- Support of float layout
- Support of toggled layouts
- Border width, color and gaps can be configured at window level
- Mirror, Reflect X and Reflect Y support on every layout
- Support of fixed windows on every layout
- Support if free window on every layout
- Dzen support
- Xinerama support (TODO)
- Java support (TODO)
Screenshots:
Website: https://github.com/nnoell/neurowm
There is no PKGBUILD at the moment and please, bear in mind that the window manager is under heavy development, so the configuration file might change a lot. Feel free to try it and leave some feedbacks.

i enjoy all the neuromancer references (wintermute). and your avatar from the cover of the c64 game. gibson would be proud ;D
I am not really good at names, that is why I take all of them from things I love. Next one won't be from neuromancer, I promisse
the wm looks very nice in your scrots. can i make some feature suggestions based on my wm experiences?
i've recently switched from awesomewm to herbsluftwm, and really like it.
- the binary tree division makes so much sense. you split a frame, then split that frame, and so on into infinity. and all those frames are movable via key-binding as well. as opposed to pre-defined layouts in awesome (and as far as i can tell, neurowm too).
- having a command line tool that you use to dynamically set properties is amazing. border colors, gaps, displays, etc. e.g. you configure you monitor settings via a command v.s. you config file, this makes it more flexible for on the fly changes.
Yes, you are right, command line tools are very useful, I might think of adding that. Regarding the binary tree division, I think it would be good to create another "special" layout (as the floated one) with its own bindings. I think I will try herbsluftwm and compare it to Xmonad so I can get to the point.
I decided to create an Xmonad-like window manager using C language because many people don't know Haskell and GHC is quite heavy. The configuration file might be difficult to understand at first (specially if you are not familiar with C language) but if you guys have any problem, don't hesitate to contact me
PD: Ninja gaiden is also an amazing franchise, specially the 3 games from the NES, played a lot when I was a kid.

How can we link the Apple iPad or any Apple device to window's based network/server?

how can we link the Apple iPad or any Apple device to window's based network/server?
we are software development company !
how to use apache developed web site from windows pc in aaple i-pad
and testing that perticuller web site on windows network !
ipad software version 5.0.1 !
How We Open developed web site in safari browser from i-pad !

No ... won't work.
If this is iPad is a first generation, the iOS should be 5.1.1.

Difficulty Connecting to WiFi From A Windows XP Based System.

Hello, this is my first post on the Apple Forums and also my first forums post using my new MacBook.
I got my MacBook from a official Apple distributer from my Polytechnic. I am required to have a MacBook in my course there, so the school has this distributer come over and sell them at discounted prices. The MacBook I bought was a Early 2008 model and the only issue I have with it is connecting to the internet. Surfing the internet is fine, apart from losing the connection a few times.
Quite often when I turn on my MacBook and log in, a screen pops up saying none of my preferred networks are available. Funny thing is my preferred network appears on the screen and I have to select my preferred network and use a 26 character password, which is thankfully saved in my keychains.
Now the problem is the connecting to the preferred network. I want my computer to do this automatically when it starts. The second, but bigger problem is that sometimes I can't connect. The computer will try for like 2 or 3 seconds and say connection timed out! I need more than 2 or 3 seconds to connect. Sometimes it says security failed.
The only way for me to get on is to keep trying sometimes more than 10 times!
my third problem is also frustrating. Whenever I close my MacBook to move it, my Messenger signs out and it takes forever to sign in!
None of the other computers in my home, using the same WiFi network are having any trouble. I am beggining to worry if my MacBook has a faulty WiFi. If this is so, it can get it replaced within 7 working days.
This is my first Mac and I want it to work perfectly.
Problems:
1) Won't automatically connect to preferred network.
2) Difficulty connecting to internet over WiFi from a Windows XP based system.
3) Windows Live Messenger logs out whenever I close my MacBook.
Hardware Involved:
1)Early 2008 MacBook, 2.4ghz, 2 gigs RAM, Leopard (Not updated, just the one pre-installed on my MacBook.)
2)Linksys Wireless-G Broadband Router
Any help will be much appreciated.

1) Yep, thats been done. This problem seems to have been solved. It was an issue yesterday, but since turned on my MacBook today morning, I haven't had any issues.
2) The Security Setting is WEP Password. Sorry I wasn't clear about the "WiFi From Windows XP." I'm not too tech savvy when it comes to networking, but my router is connected to a Windows XP PC. This PC is directly connected to the internet. In my house there is also an my MacBook, an iMac and Windows XP Laptop. Am I making any sense hehe?
3) I checked the Energy Saver, but I cannot find the option that allows me to keep my internet on while the MacBook is closed. Nothing at all. Right now, I have set my MacBook to High Performance while its plugged into a socket and its on Better Battery Life while using batteries.
Thank you so much for the help bdkjones.

Are supported Windows host based printers from HP by Netweaver?

Are Windows host based (GDI) printers from HP supported by NetWeaver?
For example HP LASERJET PROFESSIONAL P1102.
Which SPAD configuration I must set, to print for it?

Hello,
The following SAP Notes will be a good starting point for you:
[Note 1135055 - Printer Vendor Wizard Note: HP|https://service.sap.com/sap/support/notes/1135055]
[Note 1036961 - Device type selection wizard in transaction SPAD|https://service.sap.com/sap/support/notes/1036961]
Success.
Wim Van den Wyngaert

Ise 1.2.0.899 CWA Windows AD based

Similar Messages

Maybe you are looking for