ISE Inline Node

I have an ISE Inline Node that I successfully added to my admin ISE node. After I added the inline node, I wasn't able to configure it until later. When I went back to edit the configuration, the admin node says it is not able to communicate with the inline node. Below is the exact error:
Could not establish secure connection with Inline Posture node. Please be sure that certificates are configured correctly for mutual authentication between this node and the Inline Posture node.
The certificates haven't changed since I initially added the node. Also I am not able to open an SSL session to the trusted IP of the inline node. I am not sure if this is normal or not.

Yes I caught this during the upgrade, so my nodes were already deregistered. Since I was planning on rebuilding my setup I went ahead and reset the configuration (or you can issue the pep switchoutof-pep command - http://www.cisco.com/en/US/docs/security/ise/1.1/cli_ref_guide/ise_cli_app_a.html#wp2150747) in order to rollback the configuration to standalone and make the certificate change.
Just for you reference here is the link that will help you nail down the cert requirements (Step 3) -
http://www.cisco.com/en/US/docs/security/ise/1.1.1/release_notes/ise111_rn.html#wp248769
This should do the trick for you!
Tarik Admani
*Please rate helpful posts*

Similar Messages

ISE | Inline VPN deployment Issue

Hi,
I have ASA which I use for internet access and VPN gateway. I am trying to deploy ISE inline VPN node, but i found that the users traffic (from inside to internet) denied by the Inline node (users return traffic from untrusted port to trusted is blocked).... It is only permitted if i add the real IP subnet , i need to access , in the filter tab.
This is not practical because i can not exclude all internet addresses.
My questions are:
1) Is Inline VPN designed to be used only with dedicated VPN GWs?
2)Is there any workaround for this?
Thanks for any support.

The ASA code you need is 9.2.1 or later. This allows the ASA to perform CoA, thus negating the need for the Inline Posture Node.
In which mode is the IPN working? Bridged or Routed?
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Cisco ISE inline posture node Posture assessment query

Hi all,
i read the user guide for the ISE 1.1 and in the Inline posture section, I picked up the following text which concerned me if I understand it right...
"In a deployment, such as outlined in the example, when more endpoints connect to the wireless network
they are likely to fall into one of the identity groups that already have authenticated and authorized users
connected to the network.
For instance, there may be an employee, executive, and guest that have been granted access through the
outlined steps. This situation means that the respective restrictive or full-access profiles for those ID
groups have already been installed on the Inline Posture node. The subsequent endpoint authentication
and authorization uses the existing installed profiles on the Inline Posture node, unless the original
profiles have been modified at the Cisco ISE policy configuration. In the latter case, the modified profile
with ACL is downloaded and installed on the Inline Posture node, replacing the previous version."
Does this mean that if a corporate user VPNs in and successfully passes posture and gets a dACL applied to the session allowing full access, will the next user completely skip posture assessment and granted full access to the network if they are a member of the same AD group?
I am planning on using the iPEP for posturing VPN clients and using AD groups to determine the correct dACL to apply to a particular VPN session.
Thanks!
Mario

I'm not too familiar with the actual operations of the Inline Posture node, but it seems to me that the only things that are more or less "cached" are the authentication and authorization profiles that have been previously matched. So, even if they're "cached" and a endpoint matches and authorizes based on those policies, it would match on the policy that provides a pre-posture state. So, a PRE-POSTURE ACL would be pushed and an URL redirect would also occur to the NAC agent download portal (if the endpoint doesn't have it already).
After posture is assessed, a change of authorization would occur and reauthorize that endpoint's session.
So, in short, even if the profiles are cached, they only deliver pre-posture profiles. After posture assessment, the endpoint is goes through reauth via CoA.
If you have access to the partner education connection, I suggest checking out the VoE deep dive series for ISE. There's a posture presentation that would probably help you out.
https://communities.cisco.com/docs/DOC-30977
HTH,
Ryan

ISE inline posture limitation.

Hi all,
Can any one help me in configuration of ISE in inline posture mode. and What are the limitation of this mode.

The following are known limitations for Inline Posture in Cisco ISE, Release 1.0.
• Inline Posture is not supported in a virtual environment, such as VMware.
• Backup and restore is not available for Inline Posture nodes in Cisco ISE, Release 1.0.
• The Simple Network Management Protocol (SNMP) Agent is not supported by Inline Posture.
• The Cisco Discovery Protocol (CDP) is not supported by Inline Posture.
For more information over configuration and others you can see the attached PDF

Ise inline Posture

..

Understanding the Role of Inline Posture
An Inline Posture node is a gatekeeper that enforces access policies and handles change of authorization (CoA) requests. An Inline Posture node is positioned behind the network access devices on your network that are unable to accommodate CoA, such as wireless LAN controllers (WLC) and virtual private network (VPN) devices.
After the initial authentication of a client (using EAP/802.1x and RADIUS), the client must still go through posture assessment. The posture assessment process determines whether the client should be restricted, denied, or allowed full access to the network. When a client accesses the network through a WLC or VPN device, Inline Posture is responsible for the policy enforcement and CoA that these devices are unable to accommodate.
Inline Posture Policy Enforcement
Inline Posture uses RADIUS proxy and URL redirect capabilities in the control plane to manage data plane traffic for endpoints. As a RADIUS proxy, Inline Posture is able to tap into RADIUS sessions between network access devices (NADs) and RADIUS servers. NADs can open full gate to client traffic. However, Inline Posture opens only enough to allow limited traffic from clients. The restricted bandwidth allows clients the ability to have an agent provisioned, have posture assessed, and have remediation done. This restriction is accomplished by downloading and installing DACLs that are tailored for specific client flow.
Upon full compliance, a CoA is sent to the Inline Posture node by the Policy Service ISE node, and full gate is opened by the Inline Posture node for the compliant client endpoint. The RADIUS proxy downloads the full-access DACL, installs it, and associates the client IP address to it. The installed DACL can be common for a number of user groups, so that duplicate downloads are not necessary as long as the DACL content does not change at the Cisco ISE servers.
The Inline Posture policy enforcement flow illustrated in the figure above follows these steps:
1. The endpoint initiates a .1X connection to the wireless network.
2. The WLC, which is a NAD, sends a RADIUS Access-Request message to the RADIUS server (usually the Policy Service ISE node).
3. Inline Posture node, acting as a RADIUS proxy, relays the Access-Request message to the RADIUS server.
4. After authenticating the user, the RADIUS server sends a RADIUS Access-Accept message back to the Inline Posture node.
There can be a number of RADIUS transactions between the Endpoint, WLC, Inline Posture node, and the Cisco ISE RADIUS server before the Access-Accept message is sent. The process described in this example has been simplified for the sake of brevity.
5. The Inline Posture node passes the Access-Accept message to the WLC, which in turn authorizes the endpoint access, in accordance with the profile that accompanied the message.
6. The proxied Access-Accept message triggers Inline Posture to send an Authorization-Only request to the Policy Service ISE node, to retrieve the profile for the session.
7. The Policy Service ISE node returns an Access-Accept message, along with the necessary Inline Posture profile.
8. If the access control list (ACL) that is defined in the profile is not already available on the Inline Posture node, Inline Posture downloads it from the Policy Service ISE node using a RADIUS request (to the Cisco ISE RADIUS server).
9. The Cisco ISE RADIUS server sends the complete ACL in response. It is then installed in the Inline Posture data plane so that endpoint traffic passes through it.
There may be a number of transactions before the complete ACL is downloaded, especially if the ACL is too large for one transaction.
10. As the endpoint traffic arrives at the WLC, the WLC sends out a RADIUS Accounting-Start message for the session to the Inline Posture node.
The actual data traffic from the endpoint may arrive at the Inline Posture untrusted side before the Accounting-Start message is received by the Inline Posture node. Upon receiving the RADIUS Accounting-Start message, the Inline Posture node learns the IP address of the endpoint involved in the session and associates the endpoint with the ACL (downloaded and installed earlier in the session). The initial profile for this client endpoint could be restrictive, to posture the client before being given full access.
11. Assuming the restrictive ACL allows only access to Cisco ISE servers, the endpoint is only allowed actions such as agent downloading and posture assessment over the data plane.
12. If the client endpoint is posture compliant (as part of the restricted communication with Cisco ISE services earlier), the Policy Service ISE node initiates a RADIUS Change of Authorization (CoA) with the new profile. Hence, a new ACL is applied at the Inline Posture node for the session. The new ACL is installed immediately and applied to the endpoint traffic.
13. The endpoint is then capable of full access to the enterprise network, as a result of the new profile that was applied to Inline Posture.
A RADIUS stop message for a given session that is issued from the WLC, resets the corresponding endpoint access at the Inline Posture node.
Best regards,
Mantej Mangat

ISE PSN node won't join cluster

Hi All,
Has anyone seen an issue where a PSN can't join the cluster ?
We join PSN Node
-Node is registered sucessfully (sync in progress)
- 1hr later - Replication to node failed.
- Replication Sync failed due to Secondary Database is down
I have a customer where admin node and PSN are seperated by firewall.
We allow in both directions
Admin <--> PSN
ICMP
HTTPS
1521
Firewall not showing drops.
DNS and NTP are ok.
Current topology is 1 PSN, 1 Admin node.
Works fine in our test lab, but not customers environmnet.
Cheers
Peter.

You will probably need more stuff opened between the PSN and the network but your rules between Admin and PSN. You might wanna add syslog udp 20514 as well.
Also, what type of FW are you using? If ASA what happens if you run packet tracer and/or packet capture? Is the flow allowed through and do you see the packets in the capture
Last but not the least, can you confirm that the DB service is running on the secondary node? From CLI run "show application status ise" If is not either restart the node or just issue "application start ise"
Thank you for rating!

Cisco ISE Monitoring node backup size

Hello All,
We have a HA pair of ISE servers that have scheduled backups configured for the Admin persona (currently full weekly backup) and monitoring which is full weekly but with the addtional incremental daily backups. I've not seen any issue with the full weekly backup of the admin node however the monitor one provides unusual results in terms of file size between weekly and incremental backups.
Given the fact that we are currently piloting this with very little radius activity i'm curious as to how the daily backups can be bigger in filesize than the weekly?
The ISE is a ISE-3315-K9 running 1.1.3.124 and below are some examples
-rw-r--r-- 1 tsmbackup tsmbackup 502960384 Apr 21 07:08 mntincr_1_<removed>.tar.gpg (Incremental backup)
-rw-r--r-- 1 tsmbackup tsmbackup 459348307 Apr 21 01:04 mntdbfull_<removed>.tar.gpg (Full backup)
Thanks in advance for any suggestions.
M

Hi,
This could possibly due to ‘Data Purging’. When a purge operation triggers, if the actual used database disk space is greater than the configured threshold, the purge operation removes all data from the Monitoring database tables prior to the data retention window.
Following link might help in your case,
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_mnt.html#wp1074687

ISE MnT Node purge running for 6 days straight

Hi all,
Our ISE 1.1.4 patch 2 MnT node appears to be stuck in DB purge. I am getting e-mail alerts that say "Hourly purge skipped as purge is already running." Also, when I try to run a backup of the MnT node I receive the message. "Cannot submit full backup when data purging is in process."
We had received the "maximum open cursors exceeded" error. When that I happened I re-synchronized the deployment which re-started the services on the MnT node. This cleared the open cursors error but left us where we're at now. I was hoping it would clear itself with time, but it hasn't.
All I can think to do is restart the ISE services on the MnT node, but I'm a little worried about what might happen if I do that in the middle of a purge. Of course we don't have a recent backup of MnT (see above) and I would not like to lose the historical data.
I haven't opened a TAC yet, will if no answers here. We can't patch or upgrade above 1.1.4 patch 2 because we're waiting on a fix for an unrelated bug.
Any ideas appreciated, thank you.

Hi Leroy Plock,
Let me explain you the root cause of experiencing the "maximum open cursors exceeded" .
In ISE 1.1.4 Patch 1 we have introduced a new hourly purge Mechanism. Due to this feature we are experiencing this open cursors issue.
The issue 'ORA-01000: maximum open cursors exceeded' is caused because of the feature of HOURLY PURGE introduced in ISE 1.1.4 Patch 1.
On each hour a purge process is triggered and a connection to the MNT database is opened. As per the logic this opened connection should be closed right immediately after the transaction of purge process is completed. But this opened connection is not being closed and thus in a day 24 connections are kept opened.
In oracle we have set the count of 1500 open cursors and so the database will not open the cursor count beyond this value.
With the above said 24 connections opened every day this 1500 cursors will be consumed within 62 days (1500/24) and this error will then populate.
If we restart the MNT node once in a month these cursors will get freed up and then will not see this open cursor issue. This defect is addressed in ISE 1.1.4 Patch 4.
The defect for this issue is CSCuh70984

WLC Web Auth Redirect URL point to an ISE Policy NODE only?

Hi all,
I was wondering if the Web Auth Redirect URL configured in the WLC can only point to an ISE Policy Persona Node so the Web Portal feature (see below) in the ISE is only active when the ISE device has that Policy Persona activated.

Thanks Peter for your clarification regarding the semantic I used and the question I made.
Curiously, I tested it (configure the WLC Web Auth URL Redirect pointing to an ADM Node) and it did not work until I added the Policy Services persona into that ADM Node. I just wanted to verify that my test was correct because we want to make some changes in our deployment. Let me see if I can open a TAC Case in order to confirm this and add it to this post.

ISE and Node Groups

Hi,
Does anyone know if node groups are purely for policy server nodes behind a load balancer such as ACE. If you have a pair of policy server nodes at a site with no load balancer, and both nodes configured in all NAS's can these be in a node group.
Does anyone know if you can use a load balanced set of policy nodes with LWA and WLC. There has to be affinity between the portal ISE and the AAA ISE configured in the WLC, these would be two different sessions one Radius and one HTTP, so the ACE would not be able to distinguish.
Thanks.
Gary

Hi Pon -
Do you mean groups of users or group of pages?
If you mean groups of users, you can create your sub-groups as a regular groups, and then when assigning users to your Main Finance group ... add the 2 groups which are your subGroups.
If you are talking about the Portal Page Group structure, you cannot nest page groups, but you can create pages and subpages.
Hope this helps,
Candace

Cisco ISE deregister node not available

Hello,
I installed two ISE node and registered the second node. Yesterday I saw an error message: Sync failed, deregister and register the second node.
I deregistered the second node and tried register again, but not worked. Now, the second node is showing in the first node but I can not deregister or register again, how I can deregister the second node to register again?

This seems to be an issue with invalid certificates. Have you already checked the certificates on both the sides. Also restart the services of secondary nodes one and check again.
As a next step, we need to look inside ise-psc.logs to further troubleshoot this issue.
Regards,
Jatin Katyal
**Do rate helpful posts**

Connect some users on ISE Secondary node

Is it possible to connect users on secondary node?
I tried it. I configure one switch to connect on the secondary node. A computer on that switch communicate with the secondary node and get and IP address from the DHCP. but It cannot download DACL.

Yes you can point the users to the secondary server and have them authenticate, within ise the primary and secondary status only applies to admin and the monitoring personas, as as the node is running the policy services they are all considered their own standalone radius server.
please use the "debug radius authentication" and all check the replicstion status and see if it is in sync and completed.
Thanks
Tarik Admani
*Please rate helpful posts*

ISE HA / Node Group Licensing

I have a single ISE 3355 with 2200 basic licenses.
I am planning to purchase another 3355 for redundancy purposes.
Do I just add this into the node group and the license pool is shared between the nodes? I cant imagine I have to rebuy all the licenses for the 2nd device.
Thanks in advance.

That is correct. There is no need to purchase additional license paks. The ISE deployment licenses are on a per endpoint basis, not per ISE node. You can just add the new node to the existing deployment.
You have probably already seen this, but here is a guide for distributed deployments:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_dis_deploy.html
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE Admin node Replication error

Hello Everyone,
I receive this alarm some times:
Alarm
Occurred At:
Wed Mar 20 09:20:10 BRT 2013
Cause:
Replication Stopped
Details:
Replication Stopped for the host PANVMGP3301B(Secundary Admin node)
Today i go to Administration -> System -> Deplyment and i can see my secundary Admin/Monitoring node with status "REPLICATION DISABLED" see the attach image.
I can force the sync for the Primary and Secundary Admin Nodes? How i can fix this?
Tks!

Yes, something prevented your nodes from staying in sync and as a result, the nodes stopped trying to syncup. You will need to manually sync the nodes. Go to Administration > Deployment. Then select/check all of the nodes and click on the "Syncup" button above the personas.
Thank you for rating!

ISE Inline Posture and SGT

ISE Experts,
I'm doing research preparing for an SGT deployment.
We have Cisco ASA for VPN and iPEP for Posture enforecement.
The questions are:
1) Does iPEP support SGT?
2) Can I utilize SGT for VPN users?
Thanks,
Val

The Cisco TrustSec (CTS) architecture secures networks by establishing domains of trusted network devices. Once a network device authenticates with the network, the communication on the links between devices in the cloud is secured with a combination of encryption, message integrity checks, and replay protection mechanisms.
CTS use the user and device identification information acquired during the authentication phase to classify packets as they enter the network. CTS maintains classification of each packet or frame by tagging it with a security group tag (SGT) on ingress to the network so that it can be identified for applying security and other policy criteria along the data path. The tags allow network intermediaries such as switches and firewalls to enforce access control policy based on the classification.
Please check the below links which may be helpful for you in configurations:
Link-1
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_sga_pol.pdf

ISE Inline Node

Similar Messages

Maybe you are looking for