Windows RDP and 802.1x Authentications
The topic of 802.1x and Windows RDP/RDS came up in a discussion I was having with someone about the pros and cons of the Cisco AnyConnect with the Network Access Manager (NAM) module. We were
Continue readingYou have to deny to allow…..what?
ACLs on a switch are pretty straight forward. You want to only allow access to TCP ports 80 and 22 and block everything else? permit tcp any any eq 80 permit tcp any any eq
Continue readingWired Authc Success but Authz Failed?
I’ve ran into this a couple of times before. Wired authentications and authorizations look like they are working after looking at the ISE/ACS logs but the clients don’t have access to the network. When show
Continue readingACS 5.8 to ISE 2.3 Migration: Can’t save updated SID values
The latest Cisco ISE install involved migrating the customer from ACS 5.8 to ISE 2.3. They already had several authorization rules configured (over 50) in ACS so the ACS to ISE 2.3 migration tool was
Continue readingCisco ISE 2.3 Patch 2 released
Cisco ISE 2.3 Patch 2 was released at the end of January 2018. You can read about the resolved caveats here: Cisco ISE 2.3 Release Notes. Along with the bug fixes, the biggest addition that
Continue readingCisco 3850 fails to send dot1x authentications after Denali upgrade
This isn’t a Cisco ISE bug but it could affect ISE deployments. A customer had recently deployed several Cisco 3850s with Multigigabit at their headquarters. Initially, the switches were deployed with IOS XE 3.7.5. We
Continue readingGuest access with Anchor-Foreign Wireless Controllers
Wireless guest access ranks as one of the top reasons why many of my customers implement Cisco ISE. It is relatively easy to implement and gives you a lot of control over what a guest
Continue readingVMware and Cisco ISE
At least 90% of my customers utilize their existing VMware environment to run Cisco ISE instead of buying hardware (SNS-3xx5) servers. There are issues you need to be aware of when utilizing a VM environment.
Continue readingAlways verify the checksum value
I can’t emphasize this tip enough. Always verify the checksum values of any Cisco ISE download. I am talking about the install files (ISO or OVA), patch files, and upgrade bundles. It’s very easy to
Continue readingDHCP snooping and port channels
DHCP snooping is critical when using device sensors built into the switch for profiling with Cisco ISE. Setting up DHCP snooping allows the switch to collect DHCP information on endpoints which can then be forwarded
Continue reading