Cisco ISE comments Portal - DNS problem - External area

Similar Questions

• Cisco ISE comments Sponsor Isssue Portal

  Hi all

  We have insatalled 5 boxes of ise 3315 IOS 1.0.4 in our network where in two of them are admin node, two services strategy and has a node mnt. We using sponsor portal for guest user wirless comments where we integrated WLC 5508 with ise and using weblogin for guest users.

  We have created open ssid wlc and external aid redirected url to ise for the login page of comments.

  But when we create a guest in the sponsor for guest user connection, user that we faced after publication

  (1) when guest user gets connected to WiFi and connect to the portal of comments with credentials after putting the credentials then his new redirect to the same login page

  wihout invites successful connection.

  Can us guest login successful after comments connect to the portal of reviews or redirect any other link as google.com for guest user will be done the knowledge he is able to access the internet now

  (2) we have appointed time profile 8hours first user login guest. When the guest user gets connected while putting in credentials on the portal of comments.

  But we are facing problem after about 20 mins enhanced disconnects Internet and comments again Gets the login page of the portal of the guest and if we put the same credentials, then his work but after about 20 min interval disconnected Internet user.

  Can someone help me resolved on observation about covers them cisco ise comments sponsor Portal

  Thank you & best regards

  Pranav Gade

  Pranav your answers are online,

  (1) when guest user gets connected to WiFi and connect to the portal of comments with credentials after putting the credentials then his new redirect to the same login page

  wihout invites successful connection. When you use CWA (Central web authentication) there is no way we can redirect users by using the redirect url because it will always redirect users for each time they start a web request. There is no other cost functionality that will remove this condition because they have already been authenticated.  Here is a guide that explains the user experience when using web Central auth -

  http://www.Cisco.com/en/us/docs/security/ISE/1.1.1/user_guide/ise_guest_pol.html#wp1296954

  Can us guest login successful after login guest Portal comments or redirect any other link as google.com for guest user will be acquainted with it is able to access the internet now This is not possible, you can change the verbage and force the AUP to be displayed to users informing them that they can start their web request after hitting the button I accept.

  Here's to justify it experience, once users go through the process of reviews-

  http://www.Cisco.com/en/us/products/ps11640/products_configuration_example09186a0080ba6514.shtml#final

  (2) we have appointed time profile 8hours first user login guest. When the guest user gets connected while putting in credentials on the portal of comments.

  But we are facing problem after about 20 mins enhanced disconnects Internet and comments again Gets the login page of the portal of the guest and if we put the same credentials, then his work but after about 20 min interval disconnected Internet user. Check advance timer on your SSID you can be hitting the session on the WLC timeout. Please disable this option and let the functionality of COA ISE at expiration of the user on the controller sessions of.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Cisco ISE comments settings problem

  Hi all

  I hope that it will be a miracle.

  I'm unable to remove the San Jose of positions in the settings of comments with the following error ' cannot delete locations: San Jose: location referenced by another configuration. I have attached the parameters and error of reference.

  I checked all the settings in the comments tab and deleted any reference to San Jose, except if it is referenced in the configuration wizard which I wasn't involved in where else this could be referenced and how to remove it please? It is only cosmetic, but to create guest accounts it is frustrating, as shows the San Jose location when they are in fact located in the United Kingdom. I'm under Cisco ISE version 1.3.

  Thank you

  Mark

  It's a bug

  CSCus25245
  Description
  Symptom:
  In point 1.3 of the ISE, under settings - > location and SSID, we cannot delete the default location of San Jose.

  We get the error that it is referenced by another object.

  Conditions:
  ISE 1.3 - seek to remove the default location of San Jose.

• ISE comments Portal failover for new applications

  I have a controller and resilience, not ability on both nodes of the ISE 1.2 (primary and secondary).  Each node of ISE has a management interface and an interface for the portal.  PSN is active on both nodes.  The WLC chooses the ISE node (with relief) for authentication.  Guest authentication, the user should be redirected to one of the two comments. What is the best method to choose and correctly redirect the user comments portal (including when it is down).  Is there a single other solution than a LoadBalancer for this scenario. Node groups are waiting for sessions and I need a solution for new sessions.

  Thank you.

  You don't need to do, once the WLC held a PSN down, new mab requests are sent to the next psn in your list of RADIUS on the wlc and other psn will respond with its own host name in the url redirect.

• ISE comments Portal

  Hello everyone

  Is it possible to have a WLC 4402 and a WLC 5508 collaborates with comments of the ISE portal at the same time?

  I know that for the WLC 5508, it works fine and I can implement this CWA, but to the WLC 4402? I read something on the change of the certificate in the ISE in order to have as a LOA, but that reach the implemmentation CWA?

  Thanks for any suggestions.

  LWA and CWA authentication on the portal even sending comments won't be a problem. To keep things nice and clean if you can create an HTML second portal so that you can dedicate one by each process, but it is not necessary.

  I hope this helps!

  Thank you for evaluating useful messages!

• Cisco ISE synchronization and NTP server

  I am currently implementing Cisco ISE to our customer.

  But having a little problem Cisco ISE cannot synchronize with NTP server.

  Keep in mind, NTP servers in AD.

  Currently, Cisco ISE synchronize just at the local level.

  Cisco ISE implemented distributed mode, when there are two Cisco ISE installed on VMware (Administration & monitoring primary & secondary node), and another is the device (political Service node).

  As a result of it might not sync server NTP and the ISE of Cisco, Cisco ISE often OUT-OF-SYN.

  Is there a solution for this problem?

  Gandhi,

  This is a known issue, I have crossed upwards and have not read that you use AD as your NTP server, there have been problems with integration of the ISE and ACS with AD as their ntp source, please use another device like sources ntp, for example a router.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Change the URL redirection in Cisco ISE 2.1.0 comments Portal CWA

  Hello

  I've set up a guest Portal CWA with WLC 5508 8.0.133.0 and ISE 2.1.0.

  I did all the rules both Authenticatin and authorization, and I also see customers hit the rules of law. The rule of being redirects the client to a captive portal in ISE like this: cisco-av-pair = redirect url =https://ip:port/Portal/Gateway? sessionId = SessionIdValue & Portal = d30c7eb0...

  I have 3 different customer portals for each SSID and everything works fine.

  The problem is that, when the wireless client receives the URL ISE redictect (URL to access the portal of ISE comments), this URL is based on ISE DNS name, not on its IP address. My ISE FULL domain name is iselab01.example.local and the certificate indicating that the portal comments field is example.local.

  Now I was asked to create a new portal of comments but this time I have the certificate belongs to the domain example.org and need to redirect to this new portal comments use this new domain.

  I tried to code, in the authorization profile CWA, redirection to equivalent URL through the CISCO av pair as follows:

  Cisco-av-pair = redirect url =https://iselab01.example.org:8443/Portal/Gateway? sessionId = SessionIdValu...

  but it does not work, since the sessionIdValue is not replaced with its actual value when sending to the wireless client.

  Is it possible to change the URL for redirection of ISE somewhere just for a portal of comments?

  Best regards

  Simply use the automatic CWA parameter in the authz profile, rather than enter the cisco-av-pair yourself, you will find that you can change the part of the FQDN of the url, if the session ID is kept intact.

• The ISE comments and update of Broswer Security Portal

  Hi, last week our assistance service received a constant steam of calls regarding our wireless of comments.  For most people, the problem is that there are browser will not allow them on the portal.  After a bit of investigation, we have established that what happens on devices with the latest browsers - IE11, Firefox 39 + and Chrome.

  OS x and iOS devices and those devices with older browsers are working ok.

  We run ISE 1.1.3.124 which is a certain number of revisions behind so I assume it is the question that 'ignore' safety standards in these new browsers.

  My plan is to upgrade to version 1.2, and then to 1.3 which I had planned to do next month anyway, but I just wanted to see if there is a work around on the ISE, which can be implemented so that the upgrade is made a thoughtful and not rushed.

  Thank you.

  This problem is apparent on several Cisco - ISE and at least first Infrastructure products.

  A couple of threads to discuss and provide workarounds:

  Thread 1

  Thread 2

  ISE 1.3 (or 1.4) will fix it. In addition, ISE 1.2.1 Patch 7.

  Here's the official Cisco ISE Bug ID.

• Cisco ISE 1.4 comments account Backup

  I currently deploy portal free registry for comments, I now of questions you want to certify, I just want to know to anyone facing the same problem as me.

  (1) except REST API any way to export the guest account

  (2) backup of the Appendix will include the guest account or not

  (3) what deployment node 2, guest account will sync on both nodes?

  Sorry for the bad English.

  Kind regards

  Alan

  1.] I don't think - I can see a well on the same feature request

  CSCty82007    ENH: Export invited accounts set up in ISE

  2.] Yes - backup should have all guest accounts.

  [3.] the Cisco ISE guest services use distributed the Cisco ISE management system to allow several Cisco ISE nodes to work in a deployment. Configurations performed on the head node is replicated to the secondary nodes.

  ~ Jousset

• Authentication (Windows Server 2013) AD Cisco ISE problem

  Background:

  Has deployed two Cisco ISE 1.1.3. ISE will be used to authenticate users wireless access admin WLC and switches. Database backend is Microsoft running on Windows Server 2012 AD. Existing Cisco ACS 4.2 still running and authenticate users. There are two Cisco WLCs version 7.2.111.3.

  Wireless users authenticates to AD, through works of GBA 4.2. Access admin WLC and switches to the announcement through ISE works. Authentication with PEAP-MSCHAPv2 access and admin PAP/ASCII wireless.

  Problem:

  Wireless users cannot authenticate to the announcement through ISE. This is the error message '11051 RADIUS packet contains invalid state attribute' & '24444 Active Directory failed because of an error that is not specified in the ISE'.

  

  Conducted a detailed test of the AD of the ISE. The test was a success and the result seems fine except for the below:

  xxdc01.XX.com (10.21.3.1)

  Ping: 0 Mins Ago

  Status: down

  xxdc02.XX.com (10.21.3.2)

  Ping: 0 Mins Ago

  Status: down

  xxdc01.XX.com

  Last success: Thu Jan 1 10:00 1970

  March 11 failure: read 11:18:04 2013

  Success: 0

  Chess: 11006

  xxdc02.XX.com

  Last success: Fri Mar 11 09:43:31 2013

  March 11 failure: read 11:18:04 2013

  Success: 25

  Chess: 11006

  Domain controller: xxdc02.xx.com:389

  Domain controller type: unknown functional level DC: 5

  Domain name: xx.COM

  IsGlobalCatalogReady: TRUE

  DomainFunctionality: 2 = (DS_BEHAVIOR_WIN2003)

  ForestFunctionality: 2 = (DS_BEHAVIOR_WIN2003)

  Action taken:

  Log Cisco ISE and WLC by using the credentials of the AD. This excludes the connection AD, clock and AAA shared secret as the problem.

  (2) wireless authentication tested using EAP-FAST, but same problem occurs.

  (3) detailed error message shows below. This excludes any authentication and authorization policies. Even before hitting the authentication policy, the AD search fails.

  12304 extract EAP-response containing PEAP stimulus / response

  11808 extracted EAP-response containing EAP - MSCHAP VERSION challenge response to the internal method and accepting of EAP - MSCHAP VERSION such as negotiated

  Evaluate the politics of identity

  15006 set default mapping rule

  15013 selected identity Store - AD1

  24430 Authenticating user in Active Directory

  24444 active Directory operation failed because of an error that is not specified in the ISE

  (4) enabled the registration of debugging AD and had a look at the logging. Nothing significant, and no clue about the problem.

  (5) wireless tested on different mobile phones with the same error and laptos

  (6) delete and add new customer/features of AAA Cisco ISE and WLC

  (7) ISE services restarted

  (8) join domain on Cisco ISE

  (9) notes of verified version of ISE 1.1.3 and WLC 7.2.111.3 for any open caveats. Find anything related to this problem.

  10) there are two ISE and two deployed WLC. Tested a different combination of ISE1 to WLC1, ISE1 to WLC2, etc. This excludes a hardware problem of WLC.

  Other possibilities/action:

  1) test it on another version WLC. Will have to wait for approval of the failure to upgrade the WLC software.

  (2) incompatibility between Cisco ISE and AD running on Microsoft Windows Server 2012

  Did he experienced something similar to have ideas on why what is happening?

  Thank you.

  Update:

  (1) built an another Cisco ISE 1.1.3 sever in another data center that uses the same domain but other domain controller. Thai domain controller running Windows Server 2008. This work and successful authentication.

  (2) my colleague tested in a lab environment Cisco ISE 1.1.2 with Windows Server 2012. He has had the same problem as described.

  This leads me to think that there is a compatibility issue of Cisco ISE with Windows Server 2012.

  
  

  
  

  Yes, it seems that 1.1.3 doesn't support Server 2012 as of yet.

  External identity Source OS/Version

  Microsoft Windows Active Directory 2003 R2 32-bit and 64-bit

  Active Directory Microsoft Windows 2008 32-bit and 64-bit

  Microsoft Windows Active Directory 2008 R2 64-bit only

  Microsoft Windows Active Directory 2003 32-bit only

  http://www.Cisco.com/en/us/docs/security/ISE/1.1/compatibility/ise_sdt.PDF

• Cisco ISE and external syslog server

  Hi Security Experts,

  We start with deployment cisco ISE (Identity Services Engine) in our network. We have allocated 250 GB of space for the node (Admin + monitor) ISE.

  I want to know if we can send tracking of nodes of external syslog server logs after a defined time interval.

  For example, newspapers that are more than 10 days are for external syslog server. So basically our node monitoring will have the marbles which are the Max 9 days. Is this possible? Could you tell me some doc that explains the configuration of the same thing?

  Thank you

  Boudou

  No this is not possible via syslog. What you need is database purge, so that the monitoring database is purged after a determined time interval. Here's a guide that will help shed some light on this:

  http://www.Cisco.com/en/us/docs/security/ISE/1.1/user_guide/ise_mnt.html#wp1054328

  Tarik Admani
  * Please note the useful messages *.

• ISE comments 1.4 Portal certificate

  In an effort to improve the guest user to experience, we recently bought a public SSL certificate standard.  We generated the CSR of ISE and on condition that the seller to have it signed.  We then imported/bind in ISE for portals.  The goal was to reduce the certificate guests and certificate warnings.  However, after an initial test we are still getting these.  Missing something?  Is there a way to eliminate the pulse? Thank you.

  Yes if you have a complete chain installed, recharge the PSN and the test again. Alternatively, you can import the certificate .cer.

  ~ Jousset

• Cisco ISE 1.3 question Active Directory

  Hi people

  I'm having a problem with our Cisco ISE and would love some comments or a solution. I configured to ISE to use our Active Directory setup and so far it seems to be functional. I could connect to retrieve ad groups and use AD for authentication. The problem I encounter is that when I try to go to the ' Administration > Identity Management > Sources external page and select our instance AD in the window side left hand screen hangs and won't load.  Any advice?

  ad_error.PNG

  

  You are using a supported browser and have you tried an alternative one?

  If you are using a supported browser, it looks like a bug in the layout of the page. I was opening, in this case, a case of TAC. I had this same work of page very well for me in the three different 1.3 deployments.

• Group of endpoint Cisco ISE 1.4 hotspot

  Patch 1.4 Cisco ISE 6

  Cisco WLC 8.0.121

  Setup

  the WLC has a named Hotspot SSID. It uses mac auth with radius of the NAC to redirect to the Hotspot portal of reviews on the ISE.

  drops flexconnect users in vlan 401 (with preAuthAcl), after the PSU, it is initially a COA to move users to VLANs 413 with permitInternetAcl

  Description of the problem:

  users connect to the SSID of the access point and get an IP address valid in vlan 401

  redirected to the page of the hotspot on the ISE with a PSU and the PIN code request.

  are they disconnect from the network and reconnect, the ISE sends a certificate of authenticity to move to 413 without the Hotspot portal.

  what I've noticed, is that as soon as users get the redirect of the original Web page, they are moved to the endpoint group defined in the hotspot portal.

  What I've read about this behavior makes me understand that it is a default behavior, but if that's the case then I'm not sure on how I can make my font to check if the PSU has been accepted.

  Thank you

  Maarten

  Portal.PNG

  

  Policy.PNG

  

  Profile.PNG

  

  Cisco WLC 8.2.100

  Patch 1.4 ISE 6

  Similar Hotspot ISE installation, of similar rules except change VLAN. I have observed the same behavior.

  This configuration was working on patch 5.

  Update:

  I found a solution based on the following bug. Use the following attribute in the authorization rule. The success page remains but no Instant Internet access is available using this workaround solution.

  https://Tools.Cisco.com/bugsearch/bug/CSCux22558/?referring_site=bugquic...

  ' Workaround:
  "Use the LEAST 24 endpoints: LastAUPAcceptanceHours for example (means PUA agreed less than 24 hours ago).

• Question about my first payment of cisco ISE

  Hi, thanks in advance,

  It's my first time to be implemented cisco ISE 1.1.4 with Vmware Esxi v5.5

  I did so far process

  -Created NTP, DNS, AD, of course ESXI running and have link between each other, ISE is able to synchronize the time with ntp server and DNS, etc AD.

  -J' created repository for installation of application bundle - which is ise-appbundle - 1.1.4.218.i386 that I could not find any fault of the application.

  However, while I was doing installation and it said ' / opt/oracle/base/product/11.2.0/dbhome_1/bin/lsnrctl: error while loading shared libraries: libclntsh.so.11.1: cannot open shared object file: no such file or directory "."

  I already check some forums and communities, and I have no problem about synchronizing time on dns with ntp and ISE itself with ntp.

  I have no firewall between devices and no other network devices don't interfere.

  and at the end of newspapers, it comes up like this

  ########################################################################################

  ERROR: CANNOT START DB!

  Database is not available in 240 seconds Timeout.

  This could be the result of incorrect network interface configuration

  or the lack of resources on the device or the virtual computer. Please solve the problem, run the following CLI to start the database again:

  "reset - config application ise"

  ########################################################################################

  Im just lost now... Any recommendation?

  Well, it is true that the CCIE Security use ISE 1.1 as its base. So for the installation of laboratory only for this purpose, you might go with him.

  90% of the things are similar and the concepts are identical to 1.1 to 1.3. The first versions were buggy however and we recommend to all production users go with 1.3.

  A new installation of 1.14 should be OK; but you would not use the Archives of gz appbundle ISE - you need to use the new installation ISO.

  Please see screenshot below.

  ise_1.1.4_packages.PNG