ISE, Portal comments about WLC

Similar Questions

• new redirect URL of ISE 1.3 for WLC (Webauth external URL)

  Hello

  Could someone tell me the URL of ISE 1.3 for WLC?

  ISE1.2 was:

  https://ISE-1.Cisco.local:8443/guestportal/login.action

  Yes, the structure has been changed since version 1.2, and I did bother understand since there is now a button 'Portal test URL. Have you tried? Or do you still need to be able to manually browse for it?

  If you still need search manually it then you can use the test button to get the URL and then save it :)

  Thank you for evaluating useful messages!

• ISE Portal Builder Firefox Plugin is not available

  Hello

  I followed the information explained the link on how to use the generator of ISE Portal below. In this case, I'm under ISE 2.0 on VM

  However, when I get to the stage where I need to download the file at ISE, I can't find any browser plugin to use as explained.

  https://isepb.Cisco.com/blog/wp-content/uploads/2015/01/ISEPBHow-to.PDF

  Anyone know if there are browser extensions available for download these files on ISE?

  Thank you

  Hello

  You need to install the plugin: https://isepb.cisco.com/stats/uploader/latest

  Then when you are in your ISE, you will see the upcoming plugin and you can browse or drag and drop your template file exported ISE. Take a peek on this video from FAQ:

  https://isepb.Cisco.com/blog/demos

  The plugin works How - to's are in the 2nd video.

  Thank you

  PS: Please do not forget to rate and score as correct answer if this answered your question

• ISE according to the time portal comments

  G ' Day all,

  Could anyone advise if it is possible to extend or change the time profile of a guest account that has already been created? I'm trying to understand the use of time within the portal of Sponsor profiles. Imagine that a guest user has an account that gives them access to 2 weeks, by the end of the 2 weeks that the user requires another week of access.

  Of what I see as the time ISE profile page in the Developer Portal and config, is the user would have to wait before the expiry of the existing account and have a new account created or a new account must be created to grant additional access and the existing account could be deleted, I'm looking just for clarification if an extension of time for guest accounts is possible before the end of the account.

  Currently using ISE 1.1.3

  Thanks to the advanced guys.

  James.

  Hello

  Yes, I have increased the TAC issue and they notified me that the current version of ISE does not support guest accounts online updates, as the time profile sets the expiration date and then is not editable after that.

  Thank you

  Dave

• Cisco authentication at the portal comments disabled ISE

  Hey you...

  How to disabled authentication in portal invited to end users? Is it possible? We have customers who have the laptop with group policy, which allows to not show my feedback portal.

  TKS

  I do not understand your question... they have a GPO that prevents the user to see the guest SSID?  If so, you can't do something about that and have remove this restriction of group policy.  If you're talking of end-users did not pass by the portal page, then your is it connect to other SSID or circumvent your doing a mac.

  Scott

• Domain name of ISE, certificates and portal comments

  Hello world

  We have a deployment ISE using our internal domain for its FULL domain name (example: ise01.private.local). Now, we want to use for authentication of access as a guest and have noticed that the default redirect URL uses the FULL of the ISE Server domain name.

  It works very well for our business machines that we have our own generated certificates and internal certification authority. As we don't want a certificate, that the errors that occur for our clients, we need to use a public domain FULL name.

  Are we better off by changing the domain name used by the servers of the ISE, or is it possible to change the redirect URL to use a custom domain?

  I've heard suggestions that change the domain name is not supported, but I can't find another way.

  Thank you
  Mark

  Mark,

  You already have a public domain FULL name pointing to your ISE?  If so, let's assume that you authenticate you if you use a CWA.  First creat a new profile authorization, under common tasks, select redirect Web (CWA, DRW, MDM, DK, RPC), choose the authentication method (in this case, CWA) and set the ACL to use.  Just below, select the name of the static host/IP and enter the COMPLETE public domain name that points to your ISE.

  

  From there, you can create a permission policy to reference the profile that you just created.

  Please rate useful messages and mark this question as answered if, in fact, does that answer your question.  Otherwise, feel free to post additional questions.

  Charles Moreton

• ISE 1.2 does not connect failed authentications on portal comments (CWA)

  Hello

  I think it's a bug but wanted to check, if anyone knows a reason why authentication attempts failed with the non-existing user account are not connected on ISE 1.2 (CWA).

  The various cases:

  Case 1: existing username / password incorrect-> connected

  Case 2: no user / password-> connected

  Case 3: no users / connected without password->

  Case 4: nonexistent user / password-> not connected

  In my opinion, it is critical to be connected because this could be an indicator of a back attack or a password penetration test.

  Thanks in advance and best regards

  Dominic

  check that the bug listed CSCuh49137

• Cisco ISE 2.0 and WLC 5508 with 7.6.130.0

  I have looked on the release notes and compatibility n for ISE 2.0 and have not seen the answer to that. For the WLC 5508, the minimum AirOS is 7.0.116.0 but he limited the AAA authentication and support for comments. The recommended version of AirOS is 8.0.121.0.

  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/2-0/compatibility/ISE _...

  What airos 7.6.130.0? I know that AirOS release works with 1.3 and 1.4, even if they show the same support for version 2.0. I'm just afraid that something may have changed with 2.0. I am concerned only about the AAA authentication and guest access. No BYOD, posture or MDM is necessary.

  No change. Works well.

• ISE foreign CWA / deployment WLC - missing user of anchor names

  I'm not sure if this belongs to the section mobility or security - I'll just give it a try here.
  I've set up wireless access visitor with Cisco ISE 1.3 (patch 2) and a stranger WLC / anchor of deployment (7.6.130.0).
  So far almost everything works fine - but I probably have a problem with logging Cisco ISE.

  In exploitation forest 'authentications Live', I see the authentication successful, but the identity of the column, it shows just the MAC address of endpoint.
  If navigation to the identity store of endpoint endpoint of comments is in the right group (guestendpoints) and when you look at the details of the endpoint, I can see the "portalusername" who created the user.

  If I click on endpoints active view (see attachment), I can see all active clients (Authz profile "PermitAccess"). I guess the user name of the client must be filled out there as well, no?

  endpoint_view.PNG

  

  Someone has an idea what is the cause for this? Or is the normal behavior?

  My rules of authentication are:
  If "wireless_mab" and "RADIUS: Called-Station-ID ENDS WITH comments-SSID" then use "endpoints internal" and continue if "user not found".

  My authorization rules are:
  1.) if GuestEndpoints AND (Wireless_MAB AND RADIUS: Called-Station-ID ENDS_WITH Guest SSID) then PermitAccess
  2.) if (Wireless_MAB AND RADIUS: Called-Station-ID ENDS_WITH Guest SSID) then GUEST_WEBAUTH
  The profile GUEST_WEBAUTH Authz defined the CWA and preauthentication ACL for the WLC

  The WLC I just configured the WLC foreign with the RADIUS (ISE) server and active authentication MAC the SSID.
  All parameters such as aaa-override and RADIUS of the NAC are defined. The defined RADIUS is set on "settler" to comply with the ISE

  According to my experience, this is the expected behavior.  The new workflow for the use case of comments starting at the point 1.3 of the ISE typically includes registration of endpoint, you're.  Your strategy for authz for post-portail of authentication (after the certificate of authenticity) needs the MAC address to use as the identity for permissions invited, not the guest credentials used on the portal.

  That being said, I would like to be able to see the username of the user portal whenever a registered endpoint point authenticates (until it is served using endpoint political purges, of course).

  Tim

• New supplier portal - comments?

  I can't access (to approve/deny) user comments from the new portal was released. I tried on IE and Chrome.

  ETA on a fix for this?

  I see them in Firefox

• Messages authenticated in the newspapers about WLC

  I have a number of controllers of WLC and I have something a little strange on one of them.  When I look at the newspaper of trapped on this one particular controller I see not all authenticated: messages.  I see DeAuthenticated: but unauthenticated:.  There are the clients associated with the APs on that controller, and when you walk in this area with a wireless device, it seems to work.  I thought it might have something to do with the record level, but these settings look the same as the rest of them.  I don't think I'll have an operational problem, but it's just kind of weird about the logging of messages.

  Thank you

  Check the trap under MANAGEMENT journal orders > SNMP > trap controls.  Under client options, "Authentication" is selected?  usually it's off default b/c, most of the people are interested in failures and no successes.  In addition, successful fill the newspapers fairly quickly.

  Thank you

  Lee

• Cisco ISE 1.2 & Cisco WLC 5508 v7.6

  Hi all

  We intend to upgrade our WLC to 7.6 to fix a bug with FlexConnect customer ACL but I just saw on the ISE Cisco compatibility table which it recommended only up to the WLC 5508 v7.5...

  Cisco told me to avoid 7.5 as it is in a State of defferred if anyone know or are running in a laboratory or production, ISE1.2 with a WLC v7.6 n 5508?

  I wish I knew rather questions of people know before hand than to have to go through a software update, and then restore.

  Thank you all

  Mario Rosa

  Definitely stay away from 7.5. I've done several deployments with the WLCs 7.6 running. The two main issues that I touched were:

  CSCue68065 - in this bug FlexConnect ACL does not work unless you have a regular (non FlexConnect) ACL created with exactly the same name

  CSCuo39416 - CWA does not not on FlexConnect APs. It would apply to you if you have older models APs

  I hope this helps!

  Thank you for evaluating useful messages!

• 1.3 Sponsor ISE portal.

  Hi there, just try to ISE Version 1.3 and to meet some problems getting access to the portal sponsor.

  Just checking on a stand-alone deployment is allowed to have the interface portal the same sponsor that you manage the ISE of?

  I can't seem to get the portal of sponsor on 8443 just does not display the page. It does not yet the URL at the end.

  ise_sponsor_portal_2.PNG

  

  When I check the URL for him. I get this.

  ise_sponsor_portal_1.PNG

  

  The portal is created like that then I think it should work. If I use the preview in the Portal set up I can get to it very well. Am I missing something?

  ise_sponsor_portal_3.PNG

  

  Graham,

  I've seen a few times.  You have separated Ssnp?  Note that the DNS (Alias) entry for the developer portal must point to an NHP and NOT the Admin node.  This usually solves the problem.  Create an alias in DNS for the sponsor. domain.com (replace domain.com to reflect your domain name) and that it points to an NHP.  Then type sponsor. domain.com in your browser.  The system will redirect to the default portal Sponsor.

  Note that Capture of the ISE 1.3 Admin Guide:

  

  The complete guide can be found here:

  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/1-3/admin_guide/b_ise_admin_guide_13.PDF

  Please rate useful messages and mark this question as answered if, in fact, does that answer your question.  Otherwise, feel free to post additional questions.

  Charles Moreton

• How to submit your comments about a problem in the schedule provided with iOS 9?

  The issue is about the Islamic calendar which is included in iOS 9, while it is a great addition, and I personally thank you for her, the possibility of adjusting the dates if it's departure, including East missing.

  The Islamic (Hijri) calendar is based on the observations of the Moon (Crescent), a few months ends / departures only by the sighting of the new moon (Crescent).

  Examples of such is this month (Lud-Hija), the grille is off (one day advance) and there is no option to resolve this difference, which makes the bad for the rest of the Islamic year, another important month based on the sighting of the new moon is the month of Ramadan, in which Muslims around the world start fasting, Ramadan begins and ends only on observation of Red Crescent.

  All programs of Islamic calendar in the store to know this question, and they include an option to adjust the dates in days of - 2 to + 2 days in advance.

  Please see this and add the option to set the date of the Hijra accordingly as soon as possible in the iOS updates.

  It's the feedback I want to submit to Apple, it must be submitted as soon as POSSIBLE, so it can fix.

  Where and to whom can I submit this feedback?

  Thank you.

  http://www.Apple.com/feedback/iPad.html

• whenever I post a comment about a story using firefox, I received it. An error has occurred, please try again, more later (403007)

  This only happens with Firefox. IE works fine

  I don't know, but I think that this could be linked to sites that use Disqus for comments. You can check or post a link to a page that generates this problem?

  Here's a wild guess:

  If you block the "third-party" cookies, you will need to unlock. Who is on the Panel of the Privacy Options dialog box. This article help show where it is: Web sites say cookies are blocked - pledge.