Stop redirecting HTTPS!
Redirecting HTTPS requests for guest or posturing causes the browser to display certificate errors. Stop redirecting HTTPS!
Continue readingCategory: Configuration
Common ACL types used in ISE deployments and their precedence
Four common ACL types used in ISE deployments, how they function, and their precedence when applied.
Continue readingGuest portal allowing only specific AD groups (no BYOD) and sponsored guests
The customer had a pretty straightforward request. They wanted a sponsored guest portal where users could self register but had to be approved. They also wanted to allow users of a single AD group to be able to log into the portal.
Continue readingSwitch device sensors and access-reject
Sending an access-reject can cause issues when utilizing devices sensors for profiling.
Continue readingConfiguring ISE for eduroam authentication with a single policy set
The old way of specifying a proxy RADIUS service for authentications no longer works in Cisco ISE 2.3 and up because you must set the Allowed Protocols for the Policy Set itself instead of in the authentication policy. This affects how you configure ISE for eduroam authentications.
Continue readingISE RADIUS Live Logs missing IP information
I was recently called in to help a customer with a couple of issues they were having in a pilot of Cisco ISE and Firepower. They wanted to utilize pxGrid to share context information between
Continue readingYou have to deny to allow…..what?
ACLs on a switch are pretty straight forward. You want to only allow access to TCP ports 80 and 22 and block everything else? permit tcp any any eq 80 permit tcp any any eq
Continue readingACS 5.8 to ISE 2.3 Migration: Can’t save updated SID values
The latest Cisco ISE install involved migrating the customer from ACS 5.8 to ISE 2.3. They already had several authorization rules configured (over 50) in ACS so the ACS to ISE 2.3 migration tool was
Continue readingCisco ISE 2.3 Patch 2 released
Cisco ISE 2.3 Patch 2 was released at the end of January 2018. You can read about the resolved caveats here: Cisco ISE 2.3 Release Notes. Along with the bug fixes, the biggest addition that
Continue readingDHCP snooping and port channels
DHCP snooping is critical when using device sensors built into the switch for profiling with Cisco ISE. Setting up DHCP snooping allows the switch to collect DHCP information on endpoints which can then be forwarded
Continue reading