ISE and AppleTV restrictions

I am trying to find some documentation on using ISE to restrict access to an AppleTV.
My initial thought is to treat the AppleTV as a netwotk resource and enforce policies that way.
Any input is greatly appreciated
-Eric

Hey Eric,
To add to Richards great post ... In order to do 802.1X on apple tv you need to push a profile with 802.1X security. You can't manually configure 802.1X on a Apple Tv. Also, i havent tested this, but I was told if the apple tv loses power, it also loses the 802.1X profile.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Similar Messages

ISE and WLC for posture remediation

Please can anybody clarify a few things in relation to ISE and wireless posture.
1) Is the ACL-POSTURE-REDIRECT used for remediation, or is it just an ACL to redirect only some traffic to kickoff posture checking?
2) Can/Should a dACL/wACL be specified as a remediation ACL?
3) Do the WLC ACLs have to be written in long format (manually specifying source and dest ports/doesny direction any work?)
4) Does anybody have working example ACLs for posture redirect (cpp) and remediation (dACL)?
5) Any other advice or pointers would be helpful too as no docs i have found so far, be it TrustSec2, CiscoLive or anything else, dont seem to help me understand WLC posture and remediation
thanks
Nick

Nick,
Answers are inline:
1) Is the ACL-POSTURE-REDIRECT used for remediation, or is it just an ACL to redirect only some traffic to kickoff posture checking? This is for both (if ports 8905..are included) then this is for initial redirection, and remediation
2) Can/Should a dACL/wACL be specified as a remediation ACL? Wireless does not support DACL, you will have to reference another ACL in the the authorization policy, the new versions have the Airespace ACL field, where you will have the ACL defined locally on the wlc.
3) Do the WLC ACLs have to be written in long format (manually specifying source and dest ports/doesny direction any work?) Yes you have to add two entries, for example for all traffic redirection to ise...source = any, destination=iseipadd, source port=any, destination port=any direction=any action=permit
source=iseipaddr, destination ip = any, source port=any, destination port=any, direction=any action permit. Its not the easiest but I will attach a screenshot that will show you my example.
4) Does anybody have working example ACLs for posture redirect (cpp) and remediation (dACL)? ISE doesnt support DACLs so when you build your authorization profile in ISE you select the web authentication type (Posture Discovery) after that the ACL field will come up, there you will "call" the posture ACL which is defined on your controller.
5) Any other advice or pointers would be helpful too as no docs i have found so far, be it TrustSec2, CiscoLive or anything else, dont seem to help me understand WLC posture and remediation Keep in mind that you have to have radius NAC and AAA override enabled under the advanced settings for COA to work.
You have to turn on COA under the global settings in ISE (Administration > Profiling > Coa Type > Reauth)
Then you have to build your policies so that when a user connects to the network they are redirected to the download the nac agent (this is where the Posture Discovery and redirect ACL work in tandem).
Once the client download the nac agent and is compliant the report is forwarded to ISE where a COA event is triggered.
Then the client will reauthenticate and will hit another policy that will give them access once their machine is compliant, you can set the ACLs for restricted access, use dynamic vlan assignment, or just send the access-accept.
Thanks,
Tarik Admani
*Please rate helpful posts*

I have the new IPad and can't connect via bluetooth to any of my apple devices (IPhone 4s and appleTV) neither from my new IPhone 4s. When I turn the Bluetooth on, both devices keep in searching mode... I don't know what to do now... Please help

I have the new IPad and can't connect via bluetooth to any of my apple devices (IPhone 4s and appleTV) neither from my new IPhone 4s. When I turn the Bluetooth on, both devices keep in searching mode... I don't know what to do now... Please help... I can't pair any device because they can't find whitin themselves.

Wmorlac wrote:
I have the new IPad and can't connect via bluetooth to any of my apple devices...
Correct... See Supported Bluetooth Profiles Here...
http://support.apple.com/kb/HT3647
Suggest you check the User Guides of your Devices to find the Method of what you are trying to do

Home media server for mac, that you can also get to remotely. Any ideas? I am out of space on my macbook pro hard drive and appletv. Need some sort of media server for delivery to macs, ipods, ipads, etc. Any suggestions?

Hi,
I have been using my macbook pro as a home media server, hosting most content on the macbook with ipod touch, ipads, and appletv streaming/sharing content. I have run out of space on both the macbook pro and the apple tv and am looking to moving the content to a home media server. Any thoughts/suggestions? I'd like something that I can access remotely too. I have an old slingbox and also have a static IP address.
Any thoughts/suggestions would be most welcome!

Don't worry I've sorted it! I just had to turn off Reminders as well in iCloud. Calendar then worked fine, even when I turned Calendar and Reminders back on.

Ask the Expert: Cisco BYOD Wireless Solution: ISE and WLC Integration

With Jacob Ideji, Richard Hamby and Raphael Ohaemenyi
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the new Identity Solutions Engine (ISE) and Wireless LAN Controller (WLC) hardware/software, integration, features, specifications, client details, or just questions about Cisco's Bring-your-own device (BYOD) solution with cisco Experts Richard Hamby, Jacob Ideji, and Raphael Ohaemenyi. The interest in BYOD (Bring You Own Device) solutions in the enterprise has grown exponentially as guests and company users increasingly desire to use personal devices to access . Cisco BYOD enhances user experience and productivity while providing security, ease-of-administration, and performance. The heart of the Cisco wireless BYOD solution is Identity Solutions Engine (ISE) utilizing the Cisco Unified Wireless portfolio. Starting with ISE v1.1.1MR and WLC (Wireless LAN Controller) code v7.2.110.0 and higher, end-to-end wireless BYOD integration is reality.
Jacob Ideji is the technical team lead in the Cisco authentication, authorization and accounting (AAA) security team in Richardson, Texas. During his four years of experience at Cisco he has worked with Cisco VPN products, Cisco Network Admission Control (NAC) Appliance, Cisco Secure Access Control Server, and Dot1x technology as well as the current Cisco Identity Services Engine. He has a total of more than 12 years experience in the networking industry. Ideji holds CCNA, CCNP, CCSP, CCDA, CCDP, and CISM certifications from Cisco plus other industry certifications.
Richard Hamby works on the Cisco BYOD Plan, Design, Implement (PDI) Help Desk for Borderless Networks, where he is the subject matter expert on wireless, supporting partners in the deployment of Cisco Unified Wireless and Identity Services Engine solutions. Prior to his current position, Hamby was a customer support engineer with the Cisco Technical Assistance Center for 3 years on the authentication, authorization, accounting (AAA) and wireless technology teams.
Raphael Ohaemenyi Raphael Ohaemenyi is a customer support engineer with the authentication, authorization and accounting (AAA) team in the Technical Assistance Center in Richardson, Texas, where he supports Cisco customers in identity management technologies. His areas of expertise include Cisco Access Control Server, Cisco Network Admission Control (NAC) Appliance, Cisco Identity Services Engine, and IEEE 802.1X technologies. He has been at Cisco for more than 2 years and has worked in the networking industry for 8 years. He holds CCNP, CCDP, and CCSP certification.
Remember to use the rating system to let Jacob, Richard and Raphael know if you have received an adequate response.
Jacob, Richard and Raphael might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the wireless mobility sub community forum shortly after the event. This event lasts through Oct 5th, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

OOPS !!
I will repost the whole messaqge with the correct external URL's:
In general, the Trustsec design and deployment guides address the specific support for the various features of the 'whole' Cisco TS (and other security) solution frameworks. And then a drill-down (usually the proper links are embedded) to the specifc feature, and then that feature on a given device. TS 2.1 defines the use of ISE or ACS5 as the policy server, and confiugration examples for the platforms will include and refer to them.
TrustSec Home Page
http://www.cisco.com/en/US/netsol/ns1051/index.html
http://www.cisco.com/en/US/solutions/collateral/ns170/ns896/ns1051/product_bulletin_c25-712066.html
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/at_a_glance_c45-654884.pdf
I find this page very helpful as a top-level start to what features and capabilities exist per device:
http://www.cisco.com/en/US/solutions/ns170/ns896/ns1051/trustsec_matrix.html
The TS 2.1 Design Guides
http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html
DesignZone has some updated docs as well
http://www.cisco.com/en/US/netsol/ns982/networking_solutions_program_home.html#~bng
As the SGT functionality (at this point) is really more of a router/LAN/client solution, the most detailed information will be in the IOS TS guides like :
http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6.x.html
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_cts/configuration/xe-3s/asr1000/sec-usr-cts-xe-3s-asr1000-book.html
http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html

CoA issues between ISE and 3750x

We are having an issue using the cisco ise 1.1.2 and a 3750x (Version 12.2(58)SE2)
When the radius sends a reauthentication CoA message to the switch, the switch responds with a 'session contect not found' reply. I have upgraded the code to the latest levels on both the ise and switch and still have the same resultts.
This reauthenticate is needed after the NAC profiler determines the pc is complient. I am receiving the complient message from the pc and switch, but becuase the switch never reauthentices the client after the CoA request, the client is never granted full access.
I am not sure if the radius server is sending the wrong session id, or if the switch is looking at it wrong.
Please Help...!!!!!
-Debug --
Log Buffer (10000 bytes):
Feb 28 19:34:21.940 UTC: RADIUS: COA received from id 38 10.122.1.82:40171, CoA Request, len 140
Feb 28 19:34:21.940 UTC: COA: 10.122.1.82 request queued
Feb 28 19:34:21.940 UTC: RADIUS: authenticator 62 6B 15 C9 C7 A5 CA 88 - 4F B2 EE 4C A0 3D 9F 50
Feb 28 19:34:21.948 UTC: RADIUS: NAS-IP-Address      [4]   6   10.122.1.66
Feb 28 19:34:21.948 UTC: RADIUS: Event-Timestamp     [55] 6   1362080061
Feb 28 19:34:21.948 UTC: RADIUS: Message-Authenticato[80] 18
Feb 28 19:34:21.948 UTC: RADIUS:   BC B3 BA 2A 11 BD 63 0B 22 7E 82 AA C2 A5 F7 C4              [ *c"~]
Feb 28 19:34:21.948 UTC: RADIUS: Vendor, Cisco       [26] 41
Feb 28 19:34:21.948 UTC: RADIUS:   Cisco AVpair       [1]   35 "subscriber:command=reauthenticate"
Feb 28 19:34:21.948 UTC: RADIUS: Vendor, Cisco       [26] 49
Feb 28 19:34:21.948 UTC: RADIUS:   Cisco AVpair       [1]   43 "audit-session-id=0A7A014200000272048AF0F1"
Feb 28 19:34:21.948 UTC: COA: Message Authenticator decode passed
Feb 28 19:34:21.948 UTC: ++++++ CoA Attribute List ++++++
Feb 28 19:34:21.948 UTC: 07353140 0 00000001 nas-ip-address(585) 4 10.122.1.66
Feb 28 19:34:21.948 UTC: 0735375C 0 00000001 Event-Timestamp(430) 4 1362080061(512FB13D)
Feb 28 19:34:21.948 UTC: 0735376C 0 00000009 audit-session-id(794) 24 0A7A014200000272048AF0F1
Feb 28 19:34:21.948 UTC: 0735377C 0 00000009 ssg-command-code(475) 1 32
Feb 28 19:34:21.948 UTC:
Feb 28 19:34:21.957 UTC: AUTH-EVENT: auth_mgr_ch_search_record - Search record in IDC db failed
Feb 28 19:34:21.957 UTC: RADIUS/ENCODE(00000000):Orig. component type = Invalid
Feb 28 19:34:21.957 UTC: RADIUS(00000000): sending
Feb 28 19:34:21.957 UTC: RADIUS(00000000): Send CoA Nack Response to 10.122.1.82:40171 id 38, len 62
Feb 28 19:34:21.957 UTC: RADIUS: authenticator DF 18 2F 59 21 4F 84 E1 - 61 B8 43 B8 01 C5 58 B4
Feb 28 19:34:21.957 UTC: RADIUS: Reply-Message       [18] 18
Feb 28 19:34:21.957 UTC: RADIUS:   4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session]
Feb 28 19:34:21.957 UTC: RADIUS: Dynamic-Author-Error[101] 6   Session Context Not Found [503]
Feb 28 19:34:21.957 UTC: RADIUS: Message-Authenticato[80] 18
Feb 28 19:34:21.957 UTC: RADIUS:   30 C9 AE 52 80 2E A2 54 FF F3 4B C7 28 31 A9 61          [ 0R.TK(1a]
ESWHQFL02-S#
ESWHQFL02-S#
-- Switch Config -
aaa authentication login default group tacacs+ local-case
aaa authentication login local_login local
aaa authentication enable default group tacacs+ enable
aaa authentication dot1x default group radius
aaa authorization exec default group tacacs+ local
aaa authorization commands 5 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa authorization network default group radius
aaa authorization network auth-list group DOT1X
aaa accounting dot1x default start-stop group radius
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 5 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa server radius dynamic-author
client 10.122.1.82 server-key 7 14141B180F0B
client 10.122.1.80 server-key 7 045802150C2E
aaa session-id common
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server host 10.122.1.82 auth-port 1812 acct-port 1813 key 7 13061E010803
radius-server host 10.122.1.80 auth-port 1812 acct-port 1813 key 7 104D000A0618
radius-server deadtime 5
radius-server key 7 030752180500
radius-server vsa send accounting
radius-server vsa send authentication

As per the cisco recommendation IOSv12.2(52)SE is suitable for Catalyst 3750-X which will support all the features without any issues like MAB,802.1X,CWA,LWA,COA,VLAN,DACL,SAG as mentioned in the link below:
http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html.
I see you are using IOSv12.2(58)SE2,which is not recommended.So you can downgrade to IOSv12.2(52)SE which will solve your issues.

My iPad 2 doesn't have the app store I have looked in everything, reset the home screen and the restrictions is off but I still can't find it.

My iPad 2 doesn't have the app store I have looked in everything, reset the home screen and the restrictions is off but I still can't find it.

If you got the iPad from your school, and the Installing Apps restriction is 'off' but greyed out (as you 've said here https://discussions.apple.com/message/16137325#16137325) so that the App Store app is hidden, then it's likely that your school has set the restriction - you will need to ask them to remove the restriction for you.

Saving to PDF using VBA in Excel 2007 using security features such as password and print restriction

Good Afternoon,
I am wondering if there is a way to implement the security features such as password and print restriction while saving a document to PDF using VBA in Excel 2007.
Regards,
Steve

Bill,
Thank you. I was able to find the security setting section. The problem I have now, however, is writing the VBA to save to PDF and incorporate the security settings. I thought if i applied the settings to the Excel document I was working on it would carry over, but this does not seem to be the case. Any idea's?
Regards,
Steve

Photo Quality Airplay and AppleTV 2

Hi and thanks for reading,
I just bought a 50'' Full HD TV and made some test with my Apple TV 2.
I noticed that by Air Playing my iPhone photoes I have not the same definition and quality that I have by uploading my photos from my iPhone to the TV buildin photo viewer, which on the contrary makes them looking great.
Is this due to the fact that with AppleTV 2 photoes aswell are mirrored in 720p instead of 1080p?
Can I expect to fix the issue by upgrading to an AppleTV 3 @ 1080p?
Many tnxs

There are several variables here at work.
Wireless vs Wired
Video source and original quality,
Internet Speed.
Your difference between wired and wireless is really high. Unless your wifi is heavily used, or you have interference, the difference is too high to be natural. There's probably something else there cutting your bandwidth in half when you go wireless.
The higher quality a video is, the larger its file size is going to be. Which means its going to need a better internet connection to stream reasonably, otherwise its going to stop continuously to buffer. This should in general terms not affect the actual quiality of the video, only the streaming experience.
Some sites adjust the video quality depending on the internet connection to provide a smoother stream at the cost of picture quality.
Where are you viewing these Tv shows from? If Netflix is satisfactory in terms of quality, then the MacBook is not the issue.
As far as your speed goes, its average, even a little low I would say but shouyld still be capably of streaming standard definition movies correctly. .
RWP123 wrote:
Finally to confirm: the screen resolution of the ipad has no effect on the viewed picture quality on the HD TV using airplay and AppleTV?
That is correct. The screen resolution is just that. It does not affect the video output to a TV as that is more dependant on the video type. All 3 iPads currently on the market will output an HD movie at the same 1080p resolution.

Cisco ISE and SecurID Integration Questions

I'm looking for some clarity trying to understand something conceptually. I want to integrate Cisco ISE with RSA SecurID, the idea being that if the user authenticates with RSA SecurID they end up on one VLAN, however, if they don't authenticate with (or don't use, or don't have) SecurID they'll end up on another VLAN. Note that I'm not using SecurID for wireless access...all PCs are wired to Ethernet.
We have been using RSA SecurID for a while and are currently on version 8.0. Our users are authenticating via the RSA Agent typically on Windows 8.1. Instead of the usual Windows login prompt, the RSA Agent first prompts for the username and passcode (they use an app on their smartphones to get the passcode), then after a moment or two, it prompts for their Windows domain password.
We have recently installed Cisco ISE version 1.3. With the help of a local Cisco engineer and going through the "Cisco Identity Services Engine User Guide", I have it set up and running along with a few 'test' ports on our Cisco 6809 switch, it basically works...as a test it's simply set up that if they authenticate they're on one VLAN, if not, they end up on another (this is currently without using RSA...just out-of-the-box Windows authentication).
The Cisco engineer was unable to help me with RSA SecurID, so pressing on without him, out of the same user guide I have followed the directions for "RSA Identity Sources" under the "Managing Users and External Identity Sources", and that went well as far as ISE is concerned; I am now ready to get serious about getting ISE and SecurID working together.
My mistake in this design so far was assuming that the RSA agent on the Windows client PCs would communicate with Cisco ISE...there doesn't seem to be a way to have them point to a non-RSA SecurID server for authentication. The concept I'm missing is what, or how, the end-user machine is supposed to authenticate taking advantage of both ISE and SecurID.
I have dug deeper into the Cisco ISE documentation but it seems heavily biased towards Wi-Fi and BYOD implementations and it's not clear to me what applies to wired vs wireless. Perhaps it's a case that I'm not seeing the forest for the trees, but I'm not understanding what the end-user authentication looks like. It apears that as I learn more about ISE, it should become the primary SSO source, that SecurID becomes just an identity source and the PC clients would no-longer directly communicate with the SecurID servers. That being the case, do I need to replace the SecurID client on the PCs and something else Cisco-ish fills this role? An agent for ISE? How do they continue to use their passcode without the RSA agent?
Thanks!

The external db not operation indicates that there is no communication between ACS and RSA. Did you fetch the package.cab file to analyse the auth.log file?
Have you already gone through the below listed link?
http://www.security-solutions.co.za/cisco-CSACS-1113-SE-4.2-RSA-Authentication-Manager-Integration-Configuration-Example.html
Regards,
Jatin Katyal
- Do rate helpful posts -

I have a question about using multiple ipads in our school. Each of our teachers have a iPad and AppleTV in their classroom. The issue is, with our classrooms so close in proximity to one another, is there a way to pair teacher

I have a question about using multiple ipads in our school. Each of our teachers have a iPad and AppleTV in their classroom. The issue is, with our classrooms so close in proximity to one another, is there a way to pair teacher #1 iPad to its AppleTV without effecting/projecting onto the adjacent teachers #2 classroom AppleTV?

Not as such.
Give the AppleTV units unique names and also enable Airplay password in settings with unique passwords for each teacher.
AC

Why can't I make a kik account? I have IOS6 and higher and my restrictions are turned off! Please help!

Why can't I make a kik account? I have IOS6 and higher and my restrictions are turned off! Please help!

What happens when you try?
See:
iOS: An app you installed unexpectedly quits, stops responding, or won’t open
Contact the developer/go to their support site
https://kikinteractive.zendesk.com/home
Restore from backup. See:
iOS: How to back up
Restore to factory settings/new iPod

HT204291 The Apple sales rep told me I could use Airplay Mirroring between my iPad2 and AppleTV via bluetooth and I didn't need wifi. Is that true?

The Apple sales rep told me I could use Airplay Mirroring between my iPad2 and AppleTV 2 via bluetooth and I didn't need wifi. Is that true?

No. AirPlay is via Wi-Fi.
http://support.apple.com/kb/HT4437
http://support.apple.com/kb/HT5209

Can you do keynote or PPT presentations via wifi and AppleTV?

Can you do keynote or PPT presentations via wifi and AppleTV?

Not from your mac/PC, but keynote presentations from an iPad 2 with AirPlay are quite simply brilliant. Not only do you have full control of the keynote in your hands, but besides seeing the slides that everyone else is seeing, right in front of you as you look at your audience, you have your notes too.

Trouble using AirPlay between iMac and AppleTV

I'm running OS X Lion 10.7.5 and I'm having trouble using AirPlay between iMac and AppleTV (2nd Gen). It used to work fine, but for some reason it just stopped responding. I can see my media on my iMac from AppleTV and I can see AppleTV from my iMac when attempting to use AirPlay. However, when I try to pull or push media from my iMac to AppleTV it just stalls and never loads. AirPlay works fine from my iPhone and iPad with AppleTV - it's limited to my iMac only.
I'm using a Netgear R7000 wireless router and a Netgear AC120 WiFi Extender and as such, I have 4 available wireless networks (2 from the router and 2 from the extender / 2 - 2.4 GHz and 2 - 5 GHz). My internet access is great and my network performance is good across the board. All of my software/firmware is up to date (iMac, AppleTV and router/extenders). I've tried all combinations (mixing/matching) all of my wireless networks between devices (iMac/AppleTV) - nothing makes a difference (again, AirPlay works fine between my mobile devises/AppleTV). Netgear Genie has been making changes to my network settings as new firmware has been installed in both the router and extender. I'm guessing there is something screwy going on with the network settings on the iMac, but I can't figure it out.
Anyone have any suggestions?
Thanks!

I'm glad you got it all working. Out of interest, how do you (or your son) connect to the internet now? Is it just a dial-up connection? If it is, I am sure you know that, even if you get the Apple TV to share the connection, the speed will seriously limit the use of many of the Apple TV's features.
The Airport Extreme is a great router but you will need a DSL or cable modem as well as it won't connect to the internet without one. There are many great (and cheaper!) combined modem/routers available if your son wants to get a high-speed network up and running at lower cost. Any other computers, phones, games consoles etc that you may have in the house can then all connect easily.
I hope that I have helped a little and I will look out for future posts in case I can help again.

ISE and AppleTV restrictions

Similar Messages

Maybe you are looking for