Stop redirecting HTTPS!
Redirecting HTTPS requests for guest or posturing causes the browser to display certificate errors. Stop redirecting HTTPS!
Continue readingCategory: Cisco ISE
Common ACL types used in ISE deployments and their precedence
Four common ACL types used in ISE deployments, how they function, and their precedence when applied.
Continue readingGuest portal allowing only specific AD groups (no BYOD) and sponsored guests
The customer had a pretty straightforward request. They wanted a sponsored guest portal where users could self register but had to be approved. They also wanted to allow users of a single AD group to be able to log into the portal.
Continue readingSwitch device sensors and access-reject
Sending an access-reject can cause issues when utilizing devices sensors for profiling.
Continue readingConfiguring ISE for eduroam authentication with a single policy set
The old way of specifying a proxy RADIUS service for authentications no longer works in Cisco ISE 2.3 and up because you must set the Allowed Protocols for the Policy Set itself instead of in the authentication policy. This affects how you configure ISE for eduroam authentications.
Continue readingHow I perform Cisco ISE deployment upgrades
Cisco has their way (ISE 2.4 upgrade guide) of performing an ISE deployment upgrade using the CLI or GUI. Here is the way I’ve been doing them since 1.x and I’ve had a lot of success.
Continue readingISE RADIUS Live Logs missing IP information
I was recently called in to help a customer with a couple of issues they were having in a pilot of Cisco ISE and Firepower. They wanted to utilize pxGrid to share context information between
Continue readingWindows RDP and 802.1x Authentications
The topic of 802.1x and Windows RDP/RDS came up in a discussion I was having with someone about the pros and cons of the Cisco AnyConnect with the Network Access Manager (NAM) module. We were
Continue readingYou have to deny to allow…..what?
ACLs on a switch are pretty straight forward. You want to only allow access to TCP ports 80 and 22 and block everything else? permit tcp any any eq 80 permit tcp any any eq
Continue readingWired Authc Success but Authz Failed?
I’ve ran into this a couple of times before. Wired authentications and authorizations look like they are working after looking at the ISE/ACS logs but the clients don’t have access to the network. When show
Continue reading