Comments by cable CWA with ISE

Similar Questions

• Cannot open the URL of the CWA with ISE

  Hi people,

  I have a problem when you perform the CWA with ISE so that I can give you access to the network for the guests.

  Everything is fine except the URL of the CWA: when guests, open Explorer and enter a domain name after you have connected the SSID, they will be redirected to the URL like 'https://hostname.demo.com:8443 / guestportal /... ". " which begins with the hostname of the ISE and the domain name of the ISE, but for us, we have not any announcement and the LAN DNS for our network so that we cannot translate the hostname.demo.com in the IP address of the ISE, so can I just change the URL type of intellectual property like"https://10.10.10.70:8443 / guestportal?

  Screenshot of an attached screenshot (sorry).

  Basically it's in the authorization policy, allows you to use a static DNS or IP address

  

• CWA with WLC Firmware 7.0.228 and ISE 1.1.1

  Hello

  ISE Central web authentication Cisco does support the WLC version 7.0.228?

  My client has many points of access that are supported only the code of the 7.0.228 firmware.

  Cisco ISE version 1.1.1

  WLC 5500 Series, but the existing access cannot support 7.3

  Thank you

  Mathias Maneesud

  After checking the ISE both the WLC release notes, it seems as if support CWA with radius of the NAC was introduced in 7.2.110

  WLC-

  http://www.Cisco.com/en/us/docs/wireless/controller/release/notes/crn7_2_110_0.html#wp784178

  ISE-

  http://www.Cisco.com/en/us/docs/security/ISE/1.1.1/compatibility/ise_sdt.html#wp55038

  Hope that helps.

  Tarik Admani
  * Please note the useful messages *.

• Guest access with ISE and WLC LWA

  Hi guys,.

  Our company try to implement access as guest with dan ISE WLC with the local Web authentication method. But there is problem that comes with the certificate. This is the scenario:

  1. the clients are trying to connect wifi with guest SSID

  2. once it connects, you can open the browser and try to open a Web page (example: cisco.com)

  3, because guests didn't connect, so this link redirect to "ISE Guest Login Page" (become): url

  https://ISE-hostname:8443/guestportal/login.action?switch_url= https://1.1.1.1/login.html&wlan=Guest&redirect=www.cisco.com/

  )

  4. If there is no Login to ISE not installed comments Page, no reliable connection of message message, but it will be fine is they "Add Exception and install the certificate".

  

  5. once the Guest Login Page will appear and you can enter their username and password.

  

  6 connection success and they will be redirected to www.cisco.com and there pop-up 1.1.1.1 (IP of the Virtual Interface WLC) with the logout button.

  The problem occur in scenario 6, after the success of the opening session, the Web page with the address and the error of certificate ISE IP to 1.1.1.1 is appear.

  

  I know that it happened when you can has no Page of Login of WLC certificate...

  My Question is, is there a way of tunneling WLC certificate to EHT? Or what we can do for ISE validate certificate WLC, invited didn't need to install the certificate WLC / root certificate before you connect to the Wifi?

  THX 4 your answer and sorry for my bad English...

  Do not mix WLC with ISE comments Portal local Web authentication. Choose one or the other. I suggest the portal + WLC CWA.

• URL is not change after successful authenticate with ISE 1.1.1

  Hello

  I have install Cisco Identity Service Engine (1.1.1) with Wireless LAN Controller (7.2.110)

  Everything is complete, unless the redirect URL. My customer comments can join the SSID of comments and also can authenticate to ISE.

  But after they success to authenticate with ISE, the URL in the browser does not alter the pre - configure. There still be something like https://ise-ip:8443/guestportal/redir.html . Anyway the content in the browser is replaced by the URL that is configured as http://www.google.com/

  How can I do with this cause of situation that everything works well, but only the URL of the browser that is not a change to the sits one.

  Thank you

  Mathias

  Hello

  See if this thread will help, what you can do to work around the problem, is to redirect all authentications to a single Web page.

  https://supportforums.Cisco.com/message/3664154#3664154

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• WordPress cannot comment on some Blogs with Firefox 15

  15 Firefox upgrade does not recognition of the mouse on some blogs on WordPress comment box. Able to comment on these articles with IE.

  The mouse does not have a flashing cursor in the comment box, refusing the activity of keyboard

  This is a guess... 15 Firefox changed it happens an entry form has a text "space" reserved The pages of the problem have a dark theme? If you click on the field and type a few characters (even without being able to see a blinking insertion point) appear?

• I am trying to connect a Macbook Pro with Retina display for a new monitor Dell Ultrasharp 3014. I tried to connect via HDMI and DVI cable supplied with the monitor but the monitor says "no cable dvi - d".

  How to connect a Macbook Pro with the (just bought) Retina display for a Dell Ultrasharp U3014's new? I tried to connect with HDMI and DVI cable supplied with the monitor but the monitor says "no dvi - d" cable. I never tried to do that before so I'm lost.

  Use a mini-displayport cable. Connect to one of the ports Thunderbolt the MacBook Pro to ultra-compact monitor entry.

• HP Notebook: My Ethernet cable supplied with the laptop is damaged and needs new cord. How can I get a new one.

  Need new Ethernet cord that attaches to my router. But I have an extra cord (yellow) for my router. Can I use this rope? The case where and how to get the new cord. Connection is lowsy...

  Hello

  Many router vendors include a CAT5e cable with routers and in many cases, they are yellow. Didn't the yellow cable come with your router? If Yes, you can use it.

  Kind regards.

• ASA 5525 X Anyconnect configuration with ISE 2.1

  I have a new deployment of ISE 2.1 which is used only for the management of the devices at the moment.  The intention is that it will serve as radius for authentication of our VPN server.

  5525 x is a brand new ASA runs the 9.4 code.  I want to configure VPN on the SAA strategy so that each user is assigned a DAP based on their Department.

  I already have the designation of the Department for user accounts assigned in AD through a group membership.  I don't know how to get ISE to belonging to a group at the ASA so that she can associate the user based on this correct in RAP group membership.

  I succumbed to determine how this is supposed to work.  Thanks for any help.

  @Jonathan Harrison ,

  Normally we authenticate and authorize users and then push DACL or allow connection from ISE etc. of such conditions profiles that check results Posture or parts constituting the identity of the user (such as AD or another external identity store belonging to a group).

  There are a couple of good guides to do so, including detailed examples:

  https://communities.Cisco.com/docs/doc-68158

  http://www.Cisco.com/c/en/us/support/docs/security/Adaptive-Security-app...

  http://www.Cisco.com/c/en/us/support/docs/security/AnyConnect-secure-mob...

  While they focus on the case of use of Posture, they can be adapted to add other uses. For example, ISE registration condition may be the result of not only a Posture check also membership in a given group or another if you make it a State.

  I do not think we can specify to the ASA to call a given font of DAP like Hostscan module cannot be used at the same time that the module ISE Posture. However, you should be able to accomplish just about everything you used to depend on the DAP with ISE Posture Module AnyConnect (assuming you have AnyConnect 4.x Apex licenses).

  If you want to stick with the ASA DAP model, you can forgo using policies and module ISE Posture and instead create an authorization profile (result) to send the ASA, a pair of RAY - V based on a correspondence (in the authorization of the ISE policy) with the ad group. He is a "Cisco-VPN-3000" A - V called "PIX7x-members-from' that can be used in ASA dynamic access policies. You can see (and all other pairs A - v supported buy ISE) here:

  https://communities.Cisco.com/docs/doc-67894

• Jabber comments does not work with Expressway 8.7.2

  Hello

  the last Highway requires Diffie-Hellman keys at least 1024 bits in size.

  Unfortunately comments Jabber always uses 768bits as the 'server Temp key' on tomcat. This is why you cannot use Jabber comments (any version; I tried 10.6.9 and 10.6.10) with Expressway 8.7.2.

  I also checked the Tomcat settings and there is the appropriate setting in/opt/cisco/jabber/conf/mss-sip-stack-properties (which, I guess that's the relevant file):

  # 2048-bit support for the Diffie-Hellman key ephemeral
  jdk.tls.ephemeralDHKeySize = 2048

  Unfortunately, this does not work, or at least the results are not as expected.

  Try to connect with openssl (openssl s_client-connect : 5061) shows:

  -snip-

  Types of client certificate: RSA sign, DSA
  Required Signature algorithms: ECDSA + SHA512: RSA + SHA512: ECDSA + SHA384: RSA + SHA384: ECDSA + SHA256: RSA + SHA256: ECDSA + SHA224 RSA: + SHA224: ECDSA + SHA1: SHA1 + RSA: DSA + SHA1: RSA + MD5
  Required Signature shared algorithms: ECDSA + SHA512: RSA + SHA512: ECDSA + SHA384: RSA + SHA384: ECDSA + SHA256: RSA + SHA256: ECDSA + SHA224 RSA: + SHA224: ECDSA + SHA1: SHA1 + RSA: DSA + SHA1
  Peer signature digest: SHA512
  Temp server key: DH, 768 bits
  ---
  SSL handshake has read 3205 bytes and written 210 bytes
  ---
  New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA256
  The server public key is 4096 bit
  Secure renegotiation IS supported
  Compression: NONE
  Expansion: NO
  No ALPN negotiated

  -snip-

  Expressway present "key too small dh" in the log file and the 'TLS negotiation failure' when checking the status of the area.

  It works perfectly with Expressway 8.6.1 (have not tried far 8.7.1).

  Log files / dumps / snapshots are available on request, but I think the problem is pretty clear and I hope that it will be easy to solve.

  Thank you and best regards

  Wolfgang

  It's really weird, the first official Jabber client version is 10.0, I check the version of java on Jabber client 10.0, the version is "1.7.0_55".

  Where do you find the original installation image? -What have you never install any external rpm on the comment Jabber server?

  Comments of Jabber, connect with us: Administration of Cisco Jabber Guest-> marbles-> download all the

  BTW, run the command "rpm - qa' on terminal server Jabber comments and send us the list.

  Thank you

• Comment create a private with password and login access?

  Comment create a private with password and login access?

  If all you need is to grant a person/company access to a specific folder on your site (a location test for their website for example), you can usually do this from your control panel hosting account. You must consult your webhost for exact directions on how to do it.

  If you need a more robust record and the system log-in, you will need to become familiar with a language such as php server-side and a database like mySQL. DW has nothing built-in that will do these things for you, however you can use DW to encode or lining up third-party code on your site.

• Need a network Jack (RJ45) cable connector with m/b for Vaio VPCEB37FD

  Hello

  Need a network Jack (RJ45) cable connector with m/b for Vaio VPCEB37FD

  Can you please help?

  nicolashamper,

  The reference is A-1798-909-A.  You can order through parts Sony @ 800-488-7669 (US).

• Guest access with CWA on ISE 1.3

  Hi, we have implemented CWA for wireless using ISE. However there is a problem, the redirect URL is a name, not an IP address and public use DNS servers dhcp, so CWA scope comments does not work unless we put society DNS servers.

  Is it possible to configure ISE to send the ip address instead of the name of redirection in CWA?

  Concerning

  Yes, you can set a static NHP to use for redirection in the authz profile:

  authzprofile_staticpsnip.PNG

  

  But you'll find yourself with a cert for the user experience error unless you have IP addresses in the areas of SAN of the ISE certificate.  I guess you're unwanted by using internal DNS for the guest can resolve host PSN names correctly?

  Tim

• ISE 1.2 CWA with several Ssnp - SessionID replication / Session expired

  Hi all.

  I have a nodes of Services (2) policy (NSP) in a deployment of ISE launched 1.2 patch 1. We use Wireless MAB and CWA on Wireless LAN controllers v3.3.3 running 5760.

  We hit a problem in which a client comes first MAB and then is redirected to a custom portal CWA. The customer then receives a message from the Session has expired. This seems to be related to the fact that the CWA is technically an authentication of 2 floors (MAB by the WLC) and then of the CWA by the customer. Specifically, it seems to happen when the WLC makes his request to access PSN - 1 RADIUS MAB and then the customer comes to PSN - 2 to finish the CWA. This problem does not occur when a NHP is being used and all traffic authentication (RADIUS MAB and CWA) caters to a unique PSN.

  Customers solve the COMPLETE domain name in the redirect URL using DNS public and a public DNS zone file (let's call it cwa - portal example .com). CWA - portal example .com has two records for the two nodes of NHP. DNS responds to queries using Robin DNS.

  I have the Ssnp configured in a node group for replication of session information between PSN, but this does not seem to make a difference in the behavior.

  So I ask:

  What is the architecture recommended for CWA when you use more than one PSN? It seems that you must keep the stream two authentication pinned together so that they both hit the PSN even when you use more than one PSN in a deployment. A load balanced on the SessionID string balancer comes to mind (demand of RADIUS MAB and contain both the CWA URL this unique by client SessionID), but that seems awfully oversized for a seemingly simple problem. On the other hand, it seems also that by using a configuration node group should easily be able to reproduce customer SessionID to all nodes in the deployment, so that is not a problem. That is, if the WLC authenticates MAB on PSN-1, then PSN-1 should talk the group node such that when the client CWA on PSN - 2, 2 - PSN responds with a Session expiration message.

  Is there a Cisco documentation which talks about this?

  Maybe in relationship:
  https://supportforums.Cisco.com/discussion/12131531/ISE-12-guest-access-...

  Justin

  Hi Justin,

  Node groups are mainly used for redundancy of the sessions that are waiting for status.  Thus, because the controller is configured to use the PSN-1 as the first RADIUS server, PSN-1 will be the session on the client information.  This information is not shared with PSN-2 that's why you see "expired session".  In short, the node that processes applications MAB, must be the node that serves as the personalized Portal.

  Round robin DNS is preferable for use with the sponsor of the portal and portal of my devices with an FQDN that is similar to sponosr.example.com and mydevices.example.com.  For CWA, a load balancer is the best option if you want to use multiple Ssnp.  Aaron Woland wrote and article covering the ISE and the load balancing.  F5 has also some useful information on how to configure their loadbalancers with Cisco ISE.

  Kind regards

  Tim

• Guest access with CWA on ISE

  Hi community support

  We implemented just CWA for wireless using ISE. However there is a problem, the redirect URL is a name, not an IP address and public use DNS servers dhcp, so CWA scope comments does not work unless we put society DNS servers.

  so... is my question possible to configure ISE to send the ip address instead of the name of redirection in CWA?

  Thanks in advance...

  Hello Julio,.

  So far, there is no way to use the name instead of IP. ISE has always required the IP of URL redirection. To understand how to work the CWA you can see the attached PDF file.