ISE - Which is first, profiling or posturing?

Hi,
I am wondering, if both profiling and posturing is enabled on ISE, which happens first? My guess is profiling, but I could not find any Cisco document that says how this works?
Also, one more question, during client provisioning, the ISE must know the OS of the client, so that I can download the appropriate agents. So, how does ISE learn about the OS of the client? I don't think RADIUS passes this info.
Any clarification on this would be appreciated and must be pretty basic. But I am unable to find any document to prove this.
Appreciate any help.
REgards,
Mohan

Mohan,
Profiling can be done based on multipe factors, easiest way is to read user agent when user connects to a portal :-)
There are also configurable actions on ISE:
What kind of scenario are you thinking about to evaluate which is done before?
Although from logic point of view, it might make sense to evaluate what you're dealing with (profiling) before you decide whether's it's fit to access your network (posture assessment). :-)
M.

Similar Messages

ISE cannot push the profile to the cisco network setup assistant?

We have tried a few android devices with version 4.2+ but still got the error message ‘Unable to download profile.(Have you logged into the guest portal?)’ as shown at the bottom picture.
In fact, we are connecting the devices to an open SSID which performs MAC filtering, then redirect to CWA and login with AD credentials,
then redirect to Google play store and can successfully download the network setup assistant.
Could you please advise the possible reasons that would cause this error message and make ISE cannot push the profile to the cisco network setup assistant?

Here's a snipit from the Android spw.log. I see that there is an error trying to verify the hostname. Is it possible that this is caused by a non-trusted certificate? I'm using the self-signed cert built into ISE. I have an entry in the public DNS for guest.domain.com that resolves to the IP of my ISE server accessible from the guest subnet. I'm allowing all traffic from the guest VLAN to the ISE vlan on the firewall and all traffic to/from the ISE server in the provisioning ACL I have applied by ISE on the WLC during native supplicant provisioning. I know that guests can communicate with the ISE server since regular guest portal redirection works, just not the network setup assistant. I've renamed the domain to domain.com in this snipit.
2014.07.20 23:44:48 INFO:verion :4.4.4 SDK Level : 19
2014.07.20 23:44:48 INFO:State :START
2014.07.20 23:44:48 INFO:Starting Discovery
2014.07.20 23:44:48 INFO:Starting ISEDiscoveryAsynchTask
2014.07.20 23:44:48 INFO:DHCP Stringipaddr 192.168.30.110 gateway 192.168.30.1 netmask 255.255.255.0 dns1 208.67.222.222 dns2 208.67.220.220 DHCP server 192.168.30.1 lease 3600 seconds
2014.07.20 23:44:48 INFO:DHCP ipaddress192.168.30.110
2014.07.20 23:44:48 INFO:DHCP gateway192.168.30.1
2014.07.20 23:44:48 INFO:Discoverng ISE http return code :200
2014.07.20 23:44:48 INFO:ISEServer =guest.domain.com
2014.07.20 23:44:48 INFO:session =0516a8c000001932f37acc53
2014.07.20 23:44:48 INFO:Discovered using gateway :18786496
2014.07.20 23:44:48 INFO:Discovered ise server = guest.domain.com
2014.07.20 23:44:48 INFO:Discovered client mac = 5C-0A-5B-FC-37-0F
2014.07.20 23:44:48 INFO:Server:Key=guest.domain.com:0516a8c000001932f37acc53
2014.07.20 23:44:48 INFO:Downloading config fromguest.domain.com
2014.07.20 23:44:48 INFO:checkServerTrusted call
2014.07.20 23:44:48 INFO:checkServerTrusted call
2014.07.20 23:44:48 ERROR:DownloadprofileAsynchTask
2014.07.20 23:44:48 ERROR:java.io.IOException: Hostname 'guest.domain.com' was not verified
2014.07.20 23:44:48 ERROR:Hostname 'guest.domain.com' was not verified
2014.07.20 23:44:48 INFO:Internal system error.
On the ISE side, here is the snippet of logs during the same time as when the android network setup assistant was run.
2014-07-20 23:41:38,586 INFO [DefaultQuartzScheduler_Worker-6][] cisco.cpm.infrastructure.utils.NodeGroupFWUtil -:::::- Applied Firewall rules for node group.
2014-07-20 23:42:35,251 INFO [AbandonedTransactionReaper][] com.cisco.epm.db.AbandonedTransactionReaper -:::::- In AbandonedTransactionReaper : MaxActive : 20
0 CurrentActive : 0 MaxIdle : 200 MinIdle : 0 CurrentIdle : 2
2014-07-20 23:42:39,394 INFO [AbandonedTransactionReaper][] com.cisco.epm.db.AbandonedTransactionReaper -::::PDPInitialization:- In AbandonedTransactionReaper
: MaxActive : 200 CurrentActive : 0 MaxIdle : 200 MinIdle : 0 CurrentIdle : 0
2014-07-20 23:42:49,765 INFO [DataSourceListener Thread][] api.services.persistance.dao.DistributionDAO -:::::- In DAO getRepository method for HostConfig Type
: ACTIVE
2014-07-20 23:42:56,805 INFO [PDP-Heartbeats-0][] com.cisco.cpm.clustering.MnTClient -::::pdpha:- Removing session 0516a8c00000196f2a95cc53
2014-07-20 23:42:56,806 WARN [PDP-Heartbeats-0][] cpm.nsf.session.impl.SystemStateManager -::::pdpha:- Session 0516a8c00000196f2a95cc53 not found at complete
2014-07-20 23:43:35,441 INFO [portal-http-844314][] cisco.epm.license.flexlm.FlexlmFileHandler -:::::- Is License Valid for seId [1] = true
2014-07-20 23:43:35,441 INFO [portal-http-844314][] com.cisco.epm.license.LicensingManager -:::::- License is valid [true] for SeriveType [1]
2014-07-20 23:43:35,750 WARN [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- --- GuestPortalUtils: Una
ble to determine language. Defaulting to English
2014-07-20 23:43:35,768 WARN [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- --- GuestPortalUtils: Una
ble to determine language. Defaulting to English
2014-07-20 23:43:35,768 INFO [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- initializing page definit
ion
2014-07-20 23:43:35,769 INFO [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- Created guest theme page
def
2014-07-20 23:44:18,090 WARN [portal-http-844315][] cisco.cpm.guestportal.actions.SelfProvisioningAction -:test:0516a8c000001932f37acc53::guest:- ***BYOD Regi
stration Data***
macAddress: 5C:0A:5B:FC:37:0F
portalUser: test
authStoreName: Internal Users
authStoreGuid: 78954c30-e0f0-11e3-af67-005056bf4689
2014-07-20 23:44:18,113 INFO [portal-http-844315][] com.cisco.epm.jms.AQMessgeHandler -:test:0516a8c000001932f37acc53::guest:- Publishing message for event [T
xnCommit / commit] and message class[class com.cisco.epm.pap.api.transaction.Transaction]
2014-07-20 23:44:18,167 WARN [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- --- GuestPortalUtils
: Unable to determine language. Defaulting to English
2014-07-20 23:44:18,168 INFO [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- initializing page de
finition
2014-07-20 23:44:18,169 INFO [portal-http-844315][] cisco.cpm.guestportal.utils.CoAExecutorService -:test:0516a8c000001932f37acc53::guest:- Issue CoA reauth i
n 2000 milliseconds for sessionName 0516a8c000001932f37acc53
2014-07-20 23:44:18,171 WARN [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- --- GuestPortalUtils
: Unable to determine language. Defaulting to English
2014-07-20 23:44:18,172 INFO [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- initializing page de
finition
2014-07-20 23:44:18,173 INFO [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -:test:0516a8c000001932f37acc53::guest:- Created guest theme
page def
2014-07-20 23:44:20,171 INFO [pool-19-thread-4][] cisco.cpm.guestportal.utils.CoAReauthTask -:test:0516a8c000001932f37acc53::guest:- Running CoAReauthTask for
_sessionName 0516a8c000001932f37acc53
2014-07-20 23:44:20,194 INFO [pool-19-thread-4][] cisco.cpm.guestportal.utils.CoAReauthTask -:test:0516a8c000001932f37acc53::guest:- Issue Local CoA for sessi
on 0516a8c000001932f37acc53
2014-07-20 23:44:50,768 INFO [ContainerBackgroundProcessor[StandardEngine[Catalina]]][] cpm.admin.infra.action.SessionCounterListener -:::::- sessionDestroyed
- deducted one session from counter - Session ID - 0FFE9C73C9209D4EE2534558CB8F723B - Session Count - 0
2014-07-20 23:46:58,502 INFO [portal-http-844315][] cisco.epm.license.flexlm.FlexlmFileHandler -:::::- Is License Valid for seId [1] = true
2014-07-20 23:46:58,502 INFO [portal-http-844315][] com.cisco.epm.license.LicensingManager -:::::- License is valid [true] for SeriveType [1]
2014-07-20 23:46:58,693 WARN [portal-http-844315][] cisco.cpm.guestportal.utils.GuestPortalUtils -::0516a8c000001932f37acc53::guest:- --- GuestPortalUtils: Una
ble to determine language. Defaulting to English
2014-07-20 23:46:58,702 INFO [portal-http-844315][] cisco.cpm.provisioning.cache.FlowStateCacheManager -::0516a8c000001932f37acc53::guest:- Deleted old flow st
ate session with device id 5C-0A-5B-FC-37-0F

Prerequisite to enable Profiling for posture assessment to check the AV, Patches, OS update

Hi Experts,
I have wireless set-up with two SSID , one is used for corporate users with dot1x auth and other one for guest using CWA .
I understood that , i do not need to buy any license or pay to cisco for Wireless license however i want to understand for enabling profiling for posture assessment .
I understood that I need have advance license for posture assessment however I am looking out for information about costing to buy advance license and is there any prereuisite to configure posture assessment other than additional license?

There were a few changes in ISE v1.3:
- Base License = The same
- Plus License = The same (with some more features)
- Advanced License = Apex
- Wireless = Mobility (Now it includes VPN based authentications as well)
So your plan is to run the new version of ISE (1.3) and AnyConnect 4 then you will need to have:
- ISE Mobility License (Includes Base, Plus and Apex for wireless and VPN)
- AnyConnect APEX license - This one is on the honer system and it is not installed on ISE
If you plan to use posture on wired as well then instead of the "mobility" license you will need to get:
- ISE Base
- ISE Plus
- ISE Apex
- AnyConnect Apex
Thank you for rating helpful posts!

How to create a report region which the first colomn is row selector column

I want to create a report region and its first column is a row selector column. I have used select sentence to select some columns. But I do not know how set the first column to row selector column. I mean I want to do as follow. When a radio which is first column is chosen, it will return it's value of the column in the chosen row. Please help me! Thanks

Hi unnamed,
Suppose you have an id that identifies your record.
Go to Report definiton, tab report attirbutes.
Select the id of your record.
Create a link to the page you want to go to.
Hope this helps.
If not, I suggest you to create a from with report, and analyze the way the wizard has generated it.
Leo

Want to open 2nd tab and have it load the home page which the first tab opens.

Want to open 2nd tab and have it load the home page which the first tab opens. The first tab opens Google's advance search, the second tab opens a blank window. I always want Google to be in a new page.
== This happened ==
Every time Firefox opened
== always

You can look at one of these extensions:
NewTabURL : https://addons.mozilla.org/firefox/addon/2221
New Tab Homepage : https://addons.mozilla.org/firefox/addon/777

We have enterprise License through which a provisional profile was created to generate .ipa and install the organisation application to employees ipads. Its getting expire tomorrow (7th Feb'14). Do this expiration will stop the application to launch?

We have enterprise License through which a provisional profile was created to generate .ipa and install that .ipa to employees ipads. Provisional Profile getting expire tomorrow (7th Feb'14).
1. Do this expiration will stop the already installed application in employee ipads to run?
2. Also if i create some new .ipa today, can that .ipa be installed some other day or any time even after expiration of Provisional Profile?
Please help, I need the answers of above two questions as renewal of my Enterprise license and creating a new provisonal profile going to take some time in my organisation and application is must for all employees.

Guys please reply...

Autoconfig Run on which node first

Hi Guru's,
I had little confusion,
1. Where to run auto config first DB node or Apps node,
and Why (which ever is the first node),
2. if multiple Application nodes then on which node first,
3. both cases like noshared application file system and shared application system
can i run auto config on second node while applications services running on first (application) node
4. Can i have shared appl_top (not shared application file system) like in 11i in R12
thanks in advance.

1. Where to run auto config first DB node or Apps node,
and Why (which ever is the first node),It does not matter, but the common practice is to do on the database tier node then on the application tier node.
2. if multiple Application nodes then on which node first,See above.
3. both cases like noshared application file system and shared application system
can i run auto config on second node while applications services running on first (application) node Yes.
4. Can i have shared appl_top (not shared application file system) like in 11i in R12Yes -- Shared APPL_TOP FAQ [ID 243880.1]
Thanks,
Hussein

Which column first filter by oracle optimizer

Can somebody help in understand which column first filter by oracle optimizer in below example and why?
select * from emp where ENAME ='FORD'
AND SAL=3000 ;

Hi,
Look at the EXPLAIN PLAN.
Other things being equal, if there are more distinct values of ename than of sal, then it's probably checking for 'FORD' first.
For example, say the table has 100,000 rows, and there are 10,000 distinct enames, and 100 distinct sals, both ename and sal are indexed, but there is no combined index.
If you search by sal first, that means you'll expect around 1,000 rows from the index search, and then you'll have to test each of those 1,000 rows for the right ename.
If you search by ename, first, that means you'll expect around 10 rows from the index search, and you'll only have to test each of those 10 rows for the right sal.
The order in which the conditions were written will matter.
Edited by: Frank Kulash on Apr 2, 2012 7:54 AM

ISE - How long ISE will hold the profiled devices?

Hi,
After ISE profiles a device, for how long it holds that information in the endpoint identity store? Is there a purge mechanism? The reason I ask is, what if a guest comes and connects to a network and never comes back again. Will ISE hold the profiled MAC address of the device for ever? Is there a way to purge if the MAC is not seen on the network for x days? Or is there a manual purge?
Any help is appreciated.
Regards,
Mohan

I have an enhancement request in TAC asking for this feature. I have an ISE deployment which wants users to be statically assigned which will overwhelm the db after some time. I will have to check my notes and will forward the bug id to you.
Thanks,
Sent from Cisco Technical Support iPad App

ISE Guest Portal Time Profiles

G'day All,
Could someone advise if it is possible to extended or change the time profile of a guest account that has already been created? I am trying to understand using time profiles from within the Sponsor Portal. Imagine a guest user has an account created that gives them 2 weeks access, towards the end of the 2 weeks the user requires another week of access.
From what I can see in both the ISE time profiles config page and from within the sponsor portal, either the user would have to wait until the existing account expired and have a new account created or a new account would have to be created to grant the additional access, and the existing account could be deleted, I am just seeking clarification of whether time extensions for Guest Accounts is possible prior to the account expiring.
Currently using ISE 1.1.3
Thanks in advanced guys.
James.

Please follow the below steps to edite the time profile:
Adding, Editing, or Duplicating Time Profiles
To add or edit a time profile, complete the following steps:
Step 1 From the Cisco ISE Administration interface, select Administration > Guest Management > Settings > Guest > Time Profiles.
Step 2 Click one of the following:
• Add—to create a new time profile
• Edit—to edit an existing time profile
• Duplicate—to duplicate an existing time profile
Step 3 Enter the name and description of the new time profile.
Step 4 Select a Time Zone for Restrictions. Time Restrictions are a set of time periods during which a guest account associated with that time profile would not be granted access to the network or guest portal.
Step 5 From the Account Type drop- down menu, choose one of the predefined options:
• StartEnd—allows sponsors to define start and end times for account durations
• FromFirstLogin—allows sponsors to define the duration of time that guests can have access after login
• FromCreation—allows sponsors to define the duration of time that guest can have access after account creation
Step 6 Set the Duration for which the account will be active. The account expires after the duration set here has expired. This option is available only if you select the Account Type as FromFirstLogin or FromCreation.
Step 7 Set the Restrictions for the guest access.
These restrictions are composed of a day of the week and a start and end clock time. The Time Zone value specified in the time profile affects the clock times set in any of the Time Restrictions within the time profile. For example, a Time Restriction that specifies Monday 12:00 am to 8:00 am and Monday 6:00 pm to 11:59 pm would only grant system access between 8:00 am and 6:00 pm on Mondays within the time zone of the time profile. Any other day of the week would have no time restriction in this example and system access would be granted at any time.
Step 8 Click Submit.

Which Camera Calibration Profile for Leica M8 with LR3?

I see there are 4 camera profiles for the Leica M8 that all produce significantly different results - ACR3.6 and 4.4 and Adobe Standard and Camera Standard. Any advice on which to use and when?
Thanks in advance.

ACR 3.6 (this is the Adobe standard profile) when support was first introduced.
ACR 4.4 (with this version of ACR) Adobe created an updated standard profile.
Adobe standard, this is the latest profile introduced during ACR 5.x, just a new naming method
Camera standard, this is a profile created by Adobe to simulate the profile by the M8 to produce in camera jpegs.
Use the one that pleases you most, as a starting point then create your own presets to make further adjustments.

Data pulling from MARD, MARC etc. - Which table first I hv to use?

Hi Experts,
User enters the Matnr, plant, storage location inputs in the selections.
It is need to get the corresponding data from MARD, MARC, MDBS, VBBE.
So,
1) Is it possible that, suppose MARD having 10 matnrs, where as MARC is having 15, where as MDBS have only 7? or every table does hv 10 definately?
2) as I need to pull the data from these tables, pls. suggest me, in which order I hv to pull, I mean, first from Which table i hv to pull, and as second, wht is next table? for more reliability.
thanq

HI
select matnr
          LBSTF
   from mard
into table itab1
where matnr = p_matnr
condition.
if not itab[] is initial.
select EISBE
     from marc
into table itab1
for all entries in itab
where matnr = itab-matnr
and any other condition
select MENGE
      from MDBS
into table itab2
for all entries in itab1
where matnr = itab1-matnr condition
endif.
write like this
you will get data if availble

DialogListener vs Attribute Binding - Which fires first?

Hi All,
I'm using Jdeveloper 11.1.1.2.0. I'm about 3 weeks into learning this program, and could definitely be considered new to database work on this level. This is my first post. This particular problem has got me befuddled even moreso than usual. Yes, google has finally failed me.
I am attempting to create a recursive tree table based off of this helpful article: [Recursive Editable Tree|http://jobinesh.blogspot.com/2010/05/crud-operations-on-tree-table.html]
However, instead of making the fields editable on the main page, I would like to update the fields (or create new rows) through an af:popup. I accomplish this by having a button call the popup, which has the following structure:
<af:popup id="p1"
popupFetchListener="#{DialogListenerCollection.editPopupFetchListener}"
popupCanceledListener="#{DialogListenerCollection.editPopupCancelListener}">
<af:dialog id="d2"
dialogListener="#{DialogListenerCollection.editDialogListener}" title="BOM Edit">
<af:panelFormLayout id="pfl1" maxColumns="2">
<f:facet name="footer"/>
<af:panelLabelAndMessage label="Parent" id="plam1" for="ot6">
<af:outputText value="Parent Binding" id="ot6"/>
</af:panelLabelAndMessage>
<af:inputText label="Child" id="it1"
binding="#{BomCRUD.bomEditChild}"/>
<af:inputText label="Qty" id="inputText1"
binding="#{BomCRUD.bomEditQty}">
<af:convertNumber type="number" integerOnly="true"/>
</af:inputText>
</af:panelFormLayout>
</af:dialog>
</af:popup>
As you can see, the last inputText has a binding of BomCRUD.bomEditQty and is set to convert to a number of type integer. The binding has code as follows (abbreviated for space):
public class BomCRUD
private RichInputText bomEditQty;
public void setBomEditQty(RichInputText bomEditQty)
this.bomEditQty = bomEditQty;
public RichInputText getBomEditQty()
return bomEditQty;
When I enter in the values for the Child and Qty af:inputText items and press the "OK" button on the dialog, I receive the following conversion error:
Cannot create an object of type:java.lang.Number from type:oracle.adf.view.rich.component.rich.input.RichInputText with value:RichInputText[UIXEditableFacesBeanImpl, id=inputText1]
The RichInputText is not converting to a number. Why? That's a puzzle I just can't figure out. I thought logically: the next thing I should do is change BomEditQty from RichInputText to a Number type in my BomCrud class. The browser simply goes blank when I attempt that and I receive the following error:
java.lang.IllegalArgumentException: Cannot convert RichInputText[UIXEditableFacesBeanImpl, id=null] of type class oracle.adf.view.rich.component.rich.input.RichInputText to class java.lang.Number
So the next thing I thought was that my editDialogListener is firing BEFORE my BomCRUD.bomEditQty inputText binding has a chance to update, so I should modify my editDialogListener to update the binding before the "createChildren" operation call, but I do not know how to grab what was in the Qty (inputText1) field and put it in the editBomQty field.
At any rate, here is the editDialogListener:
public void editDialogListener(DialogEvent dialogEvent)
if (dialogEvent.getOutcome().name().equals("ok"))
// Put update BomCrud.setEditQty( inputText1's value ) here? How?
BindingContainer bindings = getBindings();
OperationBinding operationBinding =
bindings.getOperationBinding("createChildren");
operationBinding.execute();
The "createChildren" operation binding is located in the AppModuleImpl class, accepting a Number type for the Qty. This method creates a row and inserts the values into the recursive TreeTable at the appropriate row iterator and key.
public void createChildren(RowIterator ri, Key selectedNodeKey, String Child, Number Qty)
That about sums it up. I'm not sure if it's a conversion error, or a problem of DialogListener vs Binding priority. Any help would be appreciated. Thanks in advance guys.

Dimitar, thank you for your response.
If I am trying to insert a new row (not update an existing one), I believe I need to create a Managed Property bomEditChild under the Managed Bean bomCRUD, and then set the binding of the af:InputText to +#{bomCRUD.bomEditChild}+ as seen below:
<af:popup id="p1" ... >
<af:dialog id="d2" dialogListener="#{DialogListenerCollection.editDialogListener}" title="BOM Edit">
<af:inputText label="Child" id="it1" binding="#{BomCRUD.bomEditChild}"/>
</af:popup>
From adfc-config.xml
<managed-bean id="__11">
<managed-bean-name id="__9">BomCRUD</managed-bean-name>
<managed-bean-class id="__12">erp.view.framework.BomCRUD</managed-bean-class>
<managed-bean-scope id="__10">request</managed-bean-scope>
<managed-property id="__2">
<property-name id="__3">bomEditChild</property-name>
<property-class>oracle.adf.view.rich.component.rich.input.RichInputText</property-class>
<value id="__1"></value>
</managed-property>
</managed-bean>
However, when I print the value of the String Child variable of the createChildren class, I get the following:
System.out.println("Child: " + Child); // output command gets me the text below
+Child: RichInputText[UIXEditableFacesBeanImpl, id=it1]+
The createChildren method is detailed below in the pages definition file and implemented in the AppModuleImpl class.
<methodAction id="createChildren" ...>
<NamedData NDName="Child" NDValue="#{BomCRUD.bomEditChild}" NDType="java.lang.String"/>
</methodAction>
It appears the value being passed into my createChildren class is the container ID, not the value entered into the container by the customer. The output is the same whether I declare bomEditChild as a Managed Property under the Managed Bean bomCRUD or not. I am still unsure how to grab the value of the inputted text and/or if the managed property is updating before the createChildren method is being called via the editDialogListener.
Any further ideas?

Table name which contains status profile of a given process order

Hi All,
I created one process order and assigned a status profile for it.
I need to know which table will contain both these values.
Ex: If i give process order as an input, then it gives status profile as an output.

Hi,
The Table for Status Profile is JSTO.
But there is no direct link bitween AFKO/AFPO and JSTO.
Take the help of an ABAPer for this..
Regards,
Siva

ISE Web Authentication with Profile

   Hi,
   I'm using Web Authentication with Cisco ISE 1.2.1 without problems.
   The Cisco ISE didn't find the endpoint in my internal endpoint store and continue with Web Authentication
   But when I enable the PSN with the Profile Server, the Cisco ISE populate dynamically the internal endpoint store and I cannot use
   the Web Authentication cause the endpoint is already in the internal endpoint store.
   What's the better way to solve this problem ?
   Thanks in Advanced
   Andre Gustavo Lomonaco

    Hi Neno, let me clarify my question
    I'm already using my internal endpoints to permit authenticate via MAB my IP Phones, Access Points and Printers. I'm using Profile to be able to populate this ISE internet database.
    Now imagine that I wanna use the Web Authentication to permit authenticate guest workstations without 802.1x.If the profile put the guest workstation mac in the endpoints database, those workstation always will be authenticate using the MAC authentication and not the Web Authentication. Remember that for the Web authentication works we need to configure the continue options if the mac are not found in the endpoints database. But when the profile is on, the news (guest workstations) macs are inserted in endpoints database before I have chance to use the Web Authentication.

ISE - Which is first, profiling or posturing?

Similar Messages

Maybe you are looking for