ISE(identity services engine) Compatability with 4400 Controllers

We have mixture of wireless controllers in our environment consisting of Cisco 4400 and 5500 series wireless controllers. We are in the early stages of piloting Cisco's Identity Services Engine. I am trying to get clarification if it is fully compatible with 4400 series controllers running on 7.0.116 code, or do you have to use 5500 series on 7.2? Can someone please clarify this. Thanks.

HI,
Here is the network compatibility guide for ISE - http://www.cisco.com/en/US/docs/security/ise/1.1/compatibility/ise_sdt.html#wp55038
There are some new features (i.e. device registration web authentication) that I find very useful when you want to incorporate device registration without redirecting users to a login page, this is not supported on the 4400s since they can't run Radius NAC in mac filtering mode (i.e. fixed in 7.2). I do feel that there is a bug in this document because I have seen CWA work on the 7.0 code.
I hope this helps,
Tarik Admani

Similar Messages

Cisco ISE (Identity Services Engine) - SGA seed device?

Hi,
We are having LAB with Cisco ISE, certificates and DACL. Everything is working fine with version 1.1.1, but now we would like to use SGA-SGT functionality instead of ACL and we found that we need seed device for this and that the only device which supports this is Nexus 7000. Is that true? Is this the only way that we can use SGA-SGT? Are there any plans that any other device will be used for seed device?
BR, Marko

The seed device defined as the first device that communicates with ISE. This needs to be a Nexus.
http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf
Furthermore the Nexus needs an Advanced Services license installed in order to support Trustsec.
I can't comment on any future plans.

Unable to generate self signed certificate on secondary ISE Identity Services Engine node

certificate has expired,
we can generate a new one on the primary node
not on the secondary node that fails
with
"internal error - please ask your Administrator to review the error logs."
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
   at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
   at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
   at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
   at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
   at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
   at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
   at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
   at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source)
   at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
   at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
   at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
   at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
   at org.apache.axis.components.net.JSSESocketFactory.create(JSSESocketFactory.java:186)
   at org.apache.axis.transport.http.HTTPSender.getSocket(HTTPSender.java:191)
   at org.apache.axis.transport.http.HTTPSender.writeToSocket(HTTPSender.java:404)
   at org.apache.axis.transport.http.HTTPSender.invoke(HTTPSender.java:138)
   ... 71 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
   at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
   at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
   at sun.security.validator.Validator.validate(Unknown Source)
   at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(Unknown Source)
   at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
   at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
   ... 83 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
   at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
   at java.security.cert.CertPathBuilder.build(Unknown Source)
   ... 89 more
2015-01-15 10:27:09,270 ERROR 2015-01-15 10:27:09,270 [http-443-15][] cpm.admin.infra.action.LocalCertAddAction- Unable to import certificate : com.cisco.cpm.infrastructure.certmgmt.api.CertMgmtException: com.cisco.cpm.nsf.api.exceptions.NSFEntitySaveFailed: com.cisco.cpm.nsf.api.exceptions.NSFEntityTypeException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
2015-01-15 10:27:22,019 INFO 2015-01-15 10:27:22,019 [http-443-17][] cpm.admin.infra.action.TimeSettingsAction- retrieve server status: SEC(A), SEC(M)

What version and patch level of ISE are you running?

Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

With Eric Yu and Todd Pula
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE).
Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.
Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi Antonio,
Many great questions to start this series. For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent? Does the problem happen for one WLAN but not another? As it stands today, the CoA-Ack needs to be initiated by the management interface. This limitation is documented in bug CSCuj42870. I have provided a link for your reference below. If the problem happens 100% of the time, the two configuration areas that I would check first include:
On the WLC, navigate to Security > RADIUS > Authentication. Click on the server index number for the associated ISE node. On the edit screen, verify that the Support for RFC 3576 option is enabled.
On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question. On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked. When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface. Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface. As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
Bug Info: https://tools.cisco.com/bugsearch/bug/CSCuj42870
For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request. We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered. Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers. For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
As for product roadmap questions, we won't be able to discuss this here due to NDA. Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
Related Info:
Wireless BYOD for FlexConnect Deployment Guide

Not Working-central web-authentication with a switch and Identity Service Engine

on the followup the document "Configuration example : central web-authentication with a switch and Identity Service Engine" by Nicolas Darchis, since the redirection on the switch is not working, i'm asking for your help...
I'm using ISE Version : 1.0.4.573 and WS-C2960-24PC-L w/software 12.2(55)SE1 and image C2960-LANBASEK9-M for the access.
The interface configuration looks like this:
interface FastEthernet0/24
switchport access vlan 6
switchport mode access
switchport voice vlan 20
ip access-group webauth in
authentication event fail action next-method
authentication event server dead action authorize
authentication event server alive action reinitialize
authentication order mab
authentication priority mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
spanning-tree portfast
end
The ACL's
Extended IP access list webauth
    10 permit ip any any
Extended IP access list redirect
    10 deny ip any host 172.22.2.38
    20 permit tcp any any eq www
    30 permit tcp any any eq 443
The ISE side configuration I follow it step by step...
When I conect the XP client, e see the following Autenthication session...
swlx0x0x#show authentication sessions interface fastEthernet 0/24
           Interface: FastEthernet0/24
          MAC Address: 0015.c549.5c99
           IP Address: 172.22.3.184
            User-Name: 00-15-C5-49-5C-99
               Status: Authz Success
               Domain: DATA
       Oper host mode: single-host
     Oper control dir: both
        Authorized By: Authentication Server
           Vlan Group: N/A
     URL Redirect ACL: redirect
         URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: AC16011F000000490AC1A9E2
      Acct Session ID: 0x00000077
               Handle: 0xB7000049
Runnable methods list:
       Method   State
       mab      Authc Success
But there is no redirection, and I get the the following message on switch console:
756005: Mar 28 11:40:30: epm-redirect:IP=172.22.3.184: No redirection policy for this host
756006: Mar 28 11:40:30: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
I have to mention I'm using an http proxy on port 8080...
Any Ideas on what is going wrong?
Regards
Nuno

OK, so I upgraded the IOS to version
SW Version: 12.2(55)SE5, SW Image: C2960-LANBASEK9-M
I tweak with ACL's to the following:
Extended IP access list redirect
    10 permit ip any any (13 matches)
and created a DACL that is downloaded along with the authentication
Extended IP access list xACSACLx-IP-redirect-4f743d58 (per-user)
    10 permit ip any any
I can see the epm session
swlx0x0x#show epm session ip 172.22.3.74
     Admission feature: DOT1X
     ACS ACL: xACSACLx-IP-redirect-4f743d58
     URL Redirect ACL: redirect
     URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
And authentication
swlx0x0x#show authentication sessions interface fastEthernet 0/24
     Interface: FastEthernet0/24
     MAC Address: 0015.c549.5c99
     IP Address: 172.22.3.74
     User-Name: 00-15-C5-49-5C-99
     Status: Authz Success
     Domain: DATA
     Oper host mode: multi-auth
     Oper control dir: both
     Authorized By: Authentication Server
     Vlan Group: N/A
     ACS ACL: xACSACLx-IP-redirect-4f743d58
     URL Redirect ACL: redirect
     URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
     Session timeout: N/A
     Idle timeout: N/A
     Common Session ID: AC16011F000000160042BD98
     Acct Session ID: 0x0000001B
     Handle: 0x90000016
     Runnable methods list:
     Method   State
     mab      Authc Success
on the logging, I get the following messages...
017857: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
017858: Mar 29 11:27:04: epm-redirect:epm_redirect_cache_gen_hash: IP=172.22.3.74 Hash=271
017859: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: CacheEntryGet Success
017860: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: Ingress packet on [idb= FastEthernet0/24] matched with [acl=redirect]
017861: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Enqueue the packet with if_input=FastEthernet0/24
017862: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_process ...
017863: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Not an HTTP(s) packet
What I'm I missing?

Cisco Identity Services Engine (ISE) Version 1.2: What's New in Features and Troubleshooting Options

With Ali Mohammed
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about what’s new in Cisco Identity Services Engine (ISE) Version 1.2 and to understand the new features and enhanced troubleshooting options with Cisco expert Ali Mohammed.
Cisco ISE can be deployed as an appliance or virtual machine to enforce security policy on all devices that attempt to gain access to network infrastructure. ISE 1.2 provides feature enrichment in terms of mobile device management, BYOD enhancements, and so on. It also performs noise suppression in log collection so customers have greater ability to store and analyze logs for a longer period.
Ali Mohammed is an escalation engineer with the Security Access and Mobility Product Group (SAMPG), providing support to all Cisco NAC and Cisco ISE installed base. Ali works on complicated recreations of customer issues and helps customers in resolving configuration, deployment, setup, and integration issues involving Cisco NAC and Cisco ISE products. Ali works on enhancing tools available in ISE/NAC that are required to help troubleshoot the product setup in customer environments. Ali has six and a half years of experience at Cisco and is CCIE certified in security (number 24130).
Remember to use the rating system to let Ali know if you have received an adequate response.
Because of the volume expected during this event, Ali might not be able to answer each question. Remember that you can continue the conversation on the Security community, sub-community shortly after the event. This event lasts through September 6, 2013. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Ali,
We currently have a two-node deployment running 1.1.3.124, as depicted in diagram:
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_010.html#ID89
Question 1:
After step 1 is done, node B becomes the new primary node.
What's the license impact at that stage, when the license is mainly tied to node A, the previous primary PAN?
Step 3 says to obtain a new license that's tied to both node A & node B, as if it's implying an issue would arise, if we leave node B as the primary PAN, instead of reverting back to node A.
=========
Question 2:
When step 1 is completed, node B runs 1.2, while node A runs 1.1.3.124.
Do both nodes still function as PSN nodes, and can service end users at that point? (before we proceed to step 2)
Both nodes are behind our ACE load balancer, and I'm trying to confirm the behavior during the upgrade, to determine when to take each node out of the load balancing serverfarm, to keep the service up and avoid an outage.
===========
Question 3:
According to the upgrade guide, we're supposed to perform a config backup from PAN & MnT nodes.
Is the config backup used only when we need to rollback from 1.2 to 1.1.3, or can it be used to restore config on 1.2?
It also says to record customizations & alert settings because after the upgrade to 1.2, these settings would change, and we would need to re-configure them.
Is this correct? That's a lot of screen shots we'll need to take; is there any way to avoid this?
It says: "
Disable services such as Guest, Profiler, Device Onboarding, and so on before upgrade and enable them after upgrade. Otherwise, you must add the guest users who are lost, and devices must be profiled and onboarded again."
Exactly how do you disable services? Disable all the authorization policies?
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_01.html#reference_4EFE5E15B9854A648C9EF18D492B9105
==================
Question 4:
The 1.1 user guide says the maximum number of nodes in a node group was 4.
The 1.2 guide now says the maximum is 10.
Is there a hard limit on how many nodes can be in a node group?
We currently don't use node group, due to the lack of multicast support on the ACE-20.
Is it a big deal not to have one?
http://www.cisco.com/en/US/customer/docs/security/ise/1.2/user_guide/ise_dis_deploy.html#wp1230118
thanks,
Kevin

Ask the Expert: BYOD with Identity Services Engine

with Cisco Expert Bernardo Gaspar
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Identity Services Engine (ISE) and its various usage scenarios and integrations such as BYOD, Active Directory, profiling, posture and radius authentication with Cisco subject matter expert Bernardo Gaspar.
Bernardo Gaspar is Customer Support Engineer at the Technical Assistance Center at Cisco Europe especialized in wireless and authentication, authorization, and accounting (AAA). He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, NAC and Identity Services Engine as part of the escalation TAC team since 2007. He also focuses on filing technical and documentation bugs. Bernardo Gaspar holds a degree from the University of Porto.
Remember to use the rating system to let Bernardo know if you have received an adequate response.
Bernardo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community, AAA, Identity and NAC discussion forum shortly after the event.
This event last through Friday July 12, 2013. Visit the community often to view responses to youe questions of other community members.

My customer is limited in his VM space. Although he would like to have a active/standby for his administration node, he doesn't need this for his logging. Is it recommended to roll this in production. With a limited HDD space, what would be the recommended space (300 GB?)
administration
monitoring
policy service
Machine VM
primary
Not enabled
enabled
Machine HW
secondary
primary
enabled

Ask the Expert: BYOD with Identity Services Engine with Cisco Expert Bern

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Identity Services Engine (ISE) and its various use scenarios and integrations such as BYOD, Active Directory, profiling, posture and radius authentication with Cisco subject matter expert Bernardo Gaspar.
Bernardo Gaspar is Customer Support Engineer at the Technical Assistance Center at Cisco Europe especialized in wireless and authentication, authorization, and accounting (AAA). He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, NAC and Identity Services Engine as part of the escalation TAC team since 2007. He also focuses on filing technical and documentation bugs. Bernardo Gaspar holds a degree from the University of Porto.
Remember to use the rating system to let Bernardo know if you have received an adequate response.
Bernardo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community, AAA, Identity and NAC discussion forum shortly after the event.
This event last through Friday July 12, 2013. Visit the community often to view responses to youe questions of other community members.
Posted by WebUser Krishnakant Dixit from Cisco Support Community App

Feedback will be highly appreciated
Posted by WebUser Krishnakant Dixit from Cisco Support Community App

Cisco Identity Service Engine (ISE) (CSCup22534)--bug information

I can see this bug information, can you please help?
Cisco Identity Service Engine (ISE) (CSCup22534)

Backup Data Type
Cisco ISE allows you to back up data from the primary or standalone Administration node and from the Monitoring node. Backup can be done from the CLI or user interface.
Cisco ISE allows you to back up the following type of data:
Configuration data—Contains both application-specific and Cisco ADE operating system configuration data.
Operational Data—Contains monitoring and troubleshooting data.
Restore operation, can be performed with the backup files of previous versions of Cisco ISE and restored on a later version. For example, if you have a backup from an ISE node from Cisco ISE, Release 1.2, you can restore it on Cisco ISE, Release 1.3.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01100.html#reference_4F69987D3294499E95C1B652C4D1E73D

Does Cisco ISE-3315-K9 with ise version: Service Engine: 1.0.4.573 support command accouting like ACS

Hi
Can Anybody can update whether ISE-3315-K9 with ise version: Service Engine: 1.0.4.573 , supports the command level accounting
Bascially , we have integrated Cisco Switches with Cisco ISE for Device Authentication using Radius , we are able get the authentication logs on to the devices , but for any command changes or update done on Cisco devices we are not able to get the command accounting ..
has succeed in command level accounting on Cisco ISE ..
Please update
Cisco ISE doesn't have TACACS feature ...

Command Accounting is a TACACS+ feature so not for ISE....yet.
However, you can do the following to send commands to syslog and not including passwords (hidekeys). I just picked 200 commands/lines to store in the local command buffer/log. increase or decrease as you have memory. The notify syslog is what sends it via syslog.
conf t
archive
log config
logging enable
logging size 200
hidekeys
notify syslog
end
wr mem
Remember, syslog is clear text :-) log away from user traffic when possible. Or use TLS based syslog when possible.
I hope you find this answer useful, if it was satisfactory for you, please mark the question as Answered.
Please rate post you consider useful.
-James

 Cisco Identity Services Engine VM (eDelivery) - Part # L-ISE-VM-K9=

Hello,
I would like to know, if the following will run on Microsoft Hyper V. (Windows 2008 R2)
Cisco Identity Services Engine VM (eDelivery) - Part # L-ISE-VM-K9=
Thank you and best regards

Hello,
I would like to know, if the following will run on Microsoft Hyper V. (Windows 2008 R2)
Cisco Identity Services Engine VM (eDelivery) - Part # L-ISE-VM-K9=
Thank you and best regards

Identity Services Engine 1.1.4: REPLICATION DISABLED

Hey, guys.
Has anyone accountered the problem, that replication between ISE nodes stops after an unpredictable timeframe ???
This is the result after one day:
I have set up a distributed deployment of ISE nodes, seven in total, split up into two nodes for each service (monitoring, administration, policy and profiling).
Each of the nodes is running in an ESX 5.x environment, ESX itself is running on two hosts (two UCS with lots of ram and CPUs), each node has 8 virtual CPUs and 16GB ram, the virtual harddisks are 750GB and on some nodes even 2000GB .....
This is a testing environment, radius accounting data is sent to the ISEs by a small number of switches only (but production switches, so that I can see profiling of our real clients), no authentication or authorization is done by the ISEs (yet).
Profiling is configured in the following way:
- a single node receives the HTTP probe (via a spanned port of our proxy server) on gig 1 (box does nothing else)
- two nodes listen to the DHCP, DNS, RADIUS and SNMP probes, these two nodes have the policy service enabled also (but do nothing with it)
All nodes run the same version of ISE:
Cisco Application Deployment Engine OS Release: 2.0
ADE-OS Build Version: 2.0.4.120
ADE-OS System Architecture: i386
Copyright (c) 2005-2011 by Cisco Systems, Inc.
All rights reserved.
Hostname: ise-worf
Version information of installed applications
Cisco Identity Services Engine
Version      : 1.1.4.218
Build Date   : Wed Apr 10 22:20:22 2013
Install Date : Fri May 3 19:16:05 2013
Cisco Identity Services Engine Patch
Version      : 1
Install Date : Wed May 29 08:16:58 2013
The database on this deployment contains about 5100 clients at this time:
which is very little compared with the number of the rest of the endpoints that are connected to all the switches that do not send radius-accounting to the ISE deployment yet ....
Anyone has a solution or a clue what to do ???
In this state, ISE seems not capable to handle enterprise environments ....
Btw, backups of the database do not work either, when you have more than 50% diskspace occupied ......
Rgs
Frank

Hey, guys.
Here is a little update, repication is still disabled, but it seems to be getting even worse:
This happens when trying to connect via SSH AND via the vCenter Console window ......
A reboot of the box enabled ssh again, but the application cannot be started again ...
Disk full .... but full with what ???
Replication is disabled, so no new database entries etc. can make the db grow, I guess .. ??
The virtual disk that has been assigned to this vm is the largest size, that vmware can handle:
The only thing I can do now, is to reimage the machine (again).
Sadly, I do not expect things to be any different with the new installed ise, because I have done this three times before already...
At this point I feel the urgent need to throw this whole project onto the dumpster and take another look at ISE when version 3.0 is released, because in this state it is not enterprise scalable software ....
Rgs
Frank

Ask the Expert: Identity Services Engine - 802.1x, Identity Management and BYOD

Welcome to this Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Identity Service Engine (ISE) with subject matter expert Nicolas Darchis.
Cisco Identity Service Engine is a security policy management and control platform that automates and simplifies access control and security compliance for wired, wireless, and VPN connectivity. It is primarily used to provide secure access and guest access, support BYOD initiatives, and enforce usage policies in conjunction with Cisco TrustSec.
Nicolas Darchis is a wireless and authentication, authorization, and accounting expert for the Technical Assistance Center at Cisco Europe. He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, since 2007. He also focuses on filing technical and documentation bugs. Darchis holds a bachelor's degree in computer networking from the Haute Ecole Rennequin Sualem and a master's degree in computer science from the University of Liege. He also holds CCIE Wireless certification (no. 25344).
Remember to use the rating system to let Nicolas know if you have received an adequate response.
Because of the volume expected during this event, our expert might not be able to answer every question. Remember that you can continue the conversation in the Security community under subcommunity AAA, Identity, and NAC shortly after the event. This event lasts through June 20, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi.
1) It is not "ISE loses the credentials and asks for web portal again". Once a user is authenticated, it is authenticated as long as it stays connected. Possibilities are :
-You are returning a session timeout (attribute radius 27) in the authz profile of the user. Therefore user has to reauthenticate after X seconds. But you would see a pattern, then.
-Over wireless, many clients are not capable of doing fast roaming (smartphones is the biggest example) and will therefore reauthenticate with dot1x everytime they roam. A small coverage hole would be enough for the cached credentials to disappear and web portal to show up again
-Over wired, this cannot really occur but the idea is that it's probably the switch resetting the connection and contacting ISE again. The idea to troubleshoot this is to monitor the access device (WLC/switch) and check if the port goes up/down, if the MAB session gets reset or something and why.
2) The captive bypass issue is that Apple devices will probe apple.com website to check if there is internet connectivity. If they can reach it, then fine, if they sense that they are redirected, they open a small window pop up with the login portal. The problem (and I still cannot understand why) is that this is not Safari, it's some nameless feature-less browser that doesn't work properly.
By enabling the captive bypass feature, the WLC intercepts the requests to the Apple testpage and replies with HTTP OK. The apple device then thinks "ok I have internet connectivity" and it's up to the user to bring up a real browser to login to the portal page.
It therefore does not affect non-Apple device to have the feature enabled.
The problem is that in IOS 7.x, Apple decided to not just use Apple.com anymore but a whole list of testpages on different websites.
3) "whether it would solve the issue if I added certificate authentication as a secondary option, with eap-tls as the primary"
=> This is disturbing because EAP-TLS is a certificate authentication method. But ISE message seems to imply that the user is hitting an authnetication rule that only provides PEAP or EAP-FAST with mschap or something similar ...
If you have the windows default supplicant you have close to no control on what the client will submit. I can imagine that moving from wired to wireless, the laptop would sometimes try to send password instead of certificate and/or vice-versa. Anyconnect with fixed network profiles would solve the problem elegantly.
I cannot comment on your auth policies as I do not know them :-)
Regards,
Nicolas

ISE ( Idendity Service Engine ) & MSE (Mobility Service Engine ) & Prime Infra

What is the difference between ISE ( Idendity Service Engine ) & MSE (Mobility Service Engine ) & Prime Infra .
How this will be used along with WLC & AP & wireless Users.

The Cisco Identity Services Engine (ISE) is an all-in-one enterprise policy control product that enables comprehensive secure wired, wireless, and VPN access, leading to more productive workers and lower operations costs. When operating in a network, ISE provides the following key features: 1.Rigorous identity enforcement 2. Extensive policy enforcement 3.
Security compliance 4. Automated onboarding whereas Cisco Mobility Services Engine supports RTLS and WIPS and Cisco Prime is centralize wireless and wired Monitoring and management solution. ISE and MSE both can be integrated with Cisco Prime. For more deatil over these products you can see the below links.
http://www.cisco.com/en/US/prod/netmgtsw/prime.html
http://www.cisco.com/en/US/prod/collateral/wireless/ps9733/ps9742/data_sheet_c78-475378.html
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/data_sheet_c78-656174.html

Help, error connection Cisco Identity Services Engine with AD, global catalog port status error

Dear all,
I have Cisco Indentity Services Engine, that connected to Active Directory. When I test connection detailed,
the result is error, said:
Test Connection Results
This dialog shows the detailed logs for the operation for: idsv0018.
Status: FAILED: Global Catalog port status error.
Can anyone help?
I believe, because this error, I can't search group of AD, at Cisco ISE.
FYI: the connection from Cisco ISE to AD, joined with successful result.
Thanks,
Jerri

It's clears that when ISE tries to find the GC using the _gc._tcp. DNS query. It doesn't find that information on the Domain controller. The GC information is missing on the DC.
gc._tcp.DnsForestName
Allows a client to locate a Global Catalog (gc) server for this domain.
Jatin Katyal
- Do rate helpful posts -

ISE(identity services engine) Compatability with 4400 Controllers

Similar Messages

Maybe you are looking for