ISE UCP support

Similar Questions

• Cisco first 2.1 / 2.2 support for Cisco ise 1.3?

  Hi, I just tried to connect cisco IP 2.1 to cisco ISE 1.3, but fails.
  I read the Release Notes, only 1.2 ISE ist supported.
  But I was wondering that the ssl negotiation fails (I made a packet capture).
  So PI 2.1 has not tried to connect to the ise 1.3 via api, because of the connection fails during the ssl handshake.

  Anyway, does anyone know if ISE 1.3 will be supported with a PI or PI 2.2 version 2.1.x?

  ICC 2.1.2 supports up to 1.2 ISE.  ICC 2.2 release date is scheduled for December 2014.  Read below.

  Table 4 The Infrastructure first, Cisco and Cisco wireless version compatibility matrix

• ISE 2.0 and Ganymede

  Hello

  Anyone know when ISE version 2.0 came and Ganymede will be supported?

  Thank you in advance.

  Joana.

  ISE will support most of the GANYMEDE + v1.5 features.  This version is scheduled for November 2015.

  Please rate useful messages and mark this question as answered if, in fact, does that answer your question.  Otherwise, feel free to post additional questions.

  Charles Moreton

• Comments ISE FQDN Portal

  It is possible to create the portal comments FQDN?

  I'll try to explain.

  Requirements:

  Network WiFi 1) must be secured with L2-security(WPA2-Enterprise,PEAP) - redirect Web or not L3.

  WiFi 2 users) should use separate external Authority(AD or LDAP, not enterprise and not ISE local)

  (3) it is not necessary for managing personal devices.

  WiFi 4 users) must have the ability to change their password of the intranet portal, which is available with the FULL domain name.

  There is no problem with req 1-3, it doesn't seem like chance to create the portal only for change of user password. These requirements related to the question "mobile devices do not allow option to change password" If ISE send request to change (tested on iPhone, Android and WindowsMobile with Active Directory).

  Hi Sefedoro,

  The 1.3 ISE does support use of domain name COMPLETE with portals of comments. This can be defined in the authorization profile that specifies the CWA portal. However this FQDN of the portal comments accessible only by customers with active sessions in the comments workflow process. Also, change password via the portal of comments is supported for ISE internal comments and not AD accounts. Once network connectivity is established by a windows through WPA2-Enterprise client, a user can change his or her password via ctrl-alt - del-> change password option. If you use user or user authentication or computer begging I would test this process on a couple different windows builds.   BONE and the supplicant should automatically pick the password change. If you use an intermediate intranet portal, the user must connect to the wide and turn it on again for the laptop with the new credentials. You use the authentication of the computer (computer only) will avoid these problems.

• WebAuth LOCAL with Wireless Lan Controller and ISE

  Greetings,

  We intend to set up a centralised comments with sponsored webauth wireless network. I didn't know that this will not work with our current WLC code (6.0.199.4) as 7.2 or later version is required.

  We have a project to upgrade the WLCs but he won't be ready before the deadline for the completion of the reviews wireless.

  I am using local WebAuth temporarily until the WLCs are ready. My questions are:

  1. am I correct that I can still authenticate ISE?

  2. Since local webauth does not cost support, does that mean I can't apply a pre or post auth ACL?

  3. can someone point me to a good guide for configuring local webauth?

  Thank you!

  Hi Leroy,

  In CWA you can push the AVPs desire in the final result because of the nature of the flow:

  -Comments will connect to the SSID.

  -WLC send wireless MAB ask (1st authentication). In response, ISE returns accepted with url-redirect-acl and redirect url.

  -WLC updates the client session and once http (s) generated WLC redirects the customer to ISE according to AVPs received at the 1st auth(MAB request).

  -The customer enters the identification information in the portal. ISE valid creds and refers to WLC one type COA to re-authenticate.

  -WLC re authenticates the client (2nd authentication) session, and at this point ISE can support AVPs custom as names of VLANS, Interfaces or space air dynamic ACLs.

  -WLC overrides the client session with the new attributes.

  Local Web Auth as you mentioned, there are 2 steps but the WLC "considers" cela a single thread.

  To the LWA, the flow is as follows:

  -The client connects to the SSID.  Since there is no involved L2 auth client through DHCP, captures an IP and arrives at WebAuth_Required. Redirect URL is configured statically on WLC and pre auth ACL allows client access to ISE during the auth phase.

  -Customer opens the browser and WLC redirects the customer to ISE, but breast of redirection, there is a 'return to WLC' action which indicates to ISE to send customer WLC virtual IP containing identification information of the client used for auth in portal comments.

  -In this way the WLC now "knows" the handed creds to ISE and this way there is a formal request from RADIUS WLC sends to ISE asking these creds. ISE links in return an accept, and this is how the WLC now "knows" that auth is correct and she should move client to RUN.

  LOA of the simplest way would be to define an Interface of comments and statically applying a restrictive ACL at the level of the interface rather than wait the AVP of AAA server.

  LWA is supported in this version at very low level and basic, but if you want a complex flow involving the pusher of the dynamic attribute you will need something higher to 7.2.110.0.

  Recommended version would be 7.6.130.0 as for now.

  Kind regards

  Antonio

• 1.3 of the ISE and NAC

  I have a client that 5508 WLCs runs through the area, and I'm catching IEEE802.1x authentication for the enterprise WLAN and WebAuth for WLAN of comments... they PSK now :(

  They have ad and ISE and NAC great interest, so my immediate thoughts are to integrate ISE AD and use ISE as RADIUS server for .1x on the WLC. Then use the WLC and ISE do WebAuth for comments... It's all of the standard stuff, but it gives the background.

  Now, we come to the interesting bit... they want to run BYOD. They are involved in the financial markets, so the BYOD must be tightly controlled. They ask on ISE coupled with the NAC, but I am not convinced that I need the NAC since the arrival of the ISE1.3. Of course, I will examine three (min) SSID, corporate knowledge, comments and BYOD, just logically distinct. I have nothing that ISE 1.2 cannot press the company and comments but BYOD must full profiling and reclamation prohibition or device before access to the net.

  Someone at - he comments or suggestions? Is ISE 1.3 enough NAC-like that I don't need more, or if this is not the case, what additional benefits does that ISE can support

  Thanks for your advice/comments/experiences

  Jim

  Hi Jim -.

  Version 1.3 offers an integrated PKI and a significantly improved services reviews experience. The internal PKI is nice if the customer does not have a PKI solution in place. Don't forget however that the PKI ISE internal can only issue certificates to BYOD devices which have boarded through the ISE BYOD "flow", you cannot use the ISE PKI to issue certificates to computers in the domain.

  With regard to the NAC: you need to specify exactly what is needed here. If you were to make "posture assessment" then ISE can do for machines based on Windows and OSX. You can check for things like: A / V, a/s, status of the firewall, Windows hotfixes. If you want to make the posture on mobile devices, so you will need to integrate ISE with MDM (mobile device management) solution such as: Airwatch, Mobile, Extend360 iron, etc. ISE may question the MDM for things like: the device is protected with a PIN, is the rooted device, is the encrypted device, etc.

  I hope this helps!

  Thank you for evaluating useful messages!

• ISE EAP Tunneling SSL/TLS certificates

  Hello

  I'm working on an implementation of the ISE that will run OmniPass in several areas by using LDAP. The areas that I have in my environment are a production and post-production/tests of areas. Currently my ISE devices are related to AD production and use the certification authority certificates in our AD production. The problem I have is that I can only attribute certificate Local to be used for SSL/TLS for EAP authentcations tunneling. This means that when I try to authenticate a device that is not part of the directory assets production (pre-production), using the LDAP instance separate like identity store, his attempt to create a tunnel with a cert that is not of the CA of pre-production and so don't not with the following error...

  Failed authentication:

  12321 PEAP doesn't have SSL/TLS handshake, because the customer rejected the local certificate ISE

  This is because the device built in pre-production is not the CA production the as trusted entities. My question is, it is possible to define several certificates of separate CA to be used for SSL/TLS tunneling?

  See you soon

  Evan,

  Currently, it is not supported. However, 2 different enhancement request were filed to support this.

  CSCua59145    ISE should support multiple-server CA

  CSCud10660    Multiple subordinate CA in ISE for EAP authentication

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• ISE and SHA256?

  Hello

  I got many errors of certificates.

  When ISE Server tried to retrieve the CRL: Verification failed - CRL may be signed by all incorrect or unknown

  When the client tried to connect using EAP - TLS: X 509 decrypt error - certificate signature failure

  ISE does support SHA256?

  Thanks for your help,

  Patrick

  SHA 256 will be supported in point 1.1 of the ISE. 1.1 of the ISE will be FSC in March (this month)

• Cisco ISE SMS to prompt

  Hello

  I would check if the ISE can support sending SMS to devices in the form of [email protected]/ * / _gateway > to the sms gateway rather than just to specify the ip address of sms gateway? I've attached a screenshot of it.

  Thank you.

  It's something that I have not been able to figure it out myself. Please share if someone cela figures or open a TAC case on this subject, apprently when you integrate it with your SMTP server that outlook as a free connector with exchange that allows you to send SMS messages. But without the support option on the portal of Directors self-registration or entry Hall, I don't know how this link in all when he sends a text message.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Authentication of users invited without certififcate

  Hi team,

  I have employees doing a certificate based identification to connect to the network. But I have few users who donot have all certificates and that they want to have internet access only.

  I want to understand what all my options here are to ensure that guest users jump it authentication and don't get that the vlan internet and connect.

  Is it possible to have a rule stating ISE ignore authentication and push only internet VLAN by authorization profile. ?

  Or there is any other way available.

  Bellefroid

  Hi Bellefroid,

  There are several different ways, you can do it. The simplest and probably the best way to do this via comments portal that is already in the ISE. If it's for the wireless, you must:

  1. create a separate SSID and configure it to CWA (Central Web authentication). You can set the gate turn to AD for us Let's say allow all 'users area' authenticate

  2. you can restrict the real access either by ACL configured on the WLC (WLCs don't support the DACL) or support VLAN dynamic

  If it's a wiring, configuration is similar. You would:

  1. any of the sessions that fail 802. 1 x can be redirected to the portal of comments. The portal of the gust is adjustable again turn to AD for authentications

  2. access can be restricted via DACL (configured on ISE) or support VLAN dynamic

  Take a look at the following documentation:

  http://www.Cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-...

  http://www.Cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-...

  I hope this helps!

  Thank you for evaluating useful messages!

• ISE 1.2.1 support for Yosemite?

  Hello everyone, just curious. I see in the release notes for ISE 1.2.X that support for Mac OS 10.10 (Yosemite) was available via patch 12 on the train ISE1.2.0 of the code. That said, I see nothing in the release notes indicating support for Yosemite for any patches for ISE1.2.1, the latter being patch 3 released 1 week after ISE 1.2.0 patch 12. Please can someone tell if Yosemite is based in fact on 1.2.1 with patch 3?

  Thank you very much in advance for your help

  Jeff

  Jeff,

  OS X 10.10 is supported in ISE 1.2 p11, 1.2.1 p2 and 1.3.

  Patch 12 for 1,2 and 3 Patch 1.2.1 fix other issues for OS X 10.10, and I recommend you to update on the latest patches for these fixes.

  Here is the entry in the Release Notes detailing the fix for 10.10 to 1.2 p 12:

  

  MacOsXAgent versrion 4.9.5.3 should be used and MacOsXSPWizard 1.0.0.30

  

  Note that the description of these files refer to ISE 1.2 Patch 11/12, ISE 1.3 release and above.  ISE 1.2.1 is not mentioned, but follows the calendar bug fix and version 1.2, with an adjustment.

  Patch 1.2 10 = 1.2.1 hotfix 1

  Please rate useful messages and mark this question as answered if, in fact, does that answer your question.  Otherwise, feel free to post additional questions.

  Charles Moreton

• Supported Cisco ISE Appliance virtual HyperV

  Hello

  ISE Virtual Appliance supports VMWare ESXi hypervisor. Is there a Plan on the roadmap that ISE will rely on HyperV (or, possibly, XEN) in the future, because some customers do not have VMWare, but using only HyperV.

  The same question can be for other virtual devices as vWAAS, vASA, etc.

  Best regards

  It is a question that gets brought up in the Business Unit from time to time.  From now on, there are no plans on official Support from Cisco on any virtual platform other than ESXi from VMWare.

  There were successful on HyperV achievements, but if you have problems, the first thing that should be noted is that you use on a platform not supported.

  Please rate useful messages and mark this question as answered if, in fact, does that answer your question.  Otherwise, feel free to post additional questions.

  Charles Moreton

• Cisco Ise 1.3 with Flex to connect wireless supported function

  Hello

  My environment is formed ROUND of flex-mode connection wireless and cisco Ise 1.3, these features are supported?
  Basic functions of the AAA
  profiling
  posturing
  Substitution VLAN
  Substitution of the ACL
  Comments commissioning

  TrustSec 2.0 this MDC is not supported? someone try this feature?

  These all work with ISE 1.3 and FlexConnect WLAN.

  You need the right license ISE - the type of mobility (wireless) license will cover everything. If you have wired and wireless, then you must have basic (for most features) + more (for profiling) + Apex (for Posturing).

• Support for OS Linux in Cisco ISE

  Hi all

  Can someone help me to know. If any Linux OS posture assessment is available in ISE like Windows & MAC OS.

  Hello Mohsin-

  Evaluation of posture is not currently supported on Linux-based devices. For more information on currently supported devices, controls, etc. see the following link:

  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_010111.html

  Thank you for evaluating useful messages!

• ISE vs NGS: support of the API

  Hello

  When you want to implement access as a guest for our wireless network.

  Now, we are facing two different solutions

  (1) the comments NAC Server

  -old product (this means it will go EoS earlier)

  -does not present endpoint profile (you must use the proceeds of the NAC)

  -It is easily manageable our entry Hall software, via https request (for example to create a user)

  (2) ISE

  -new product (better support timespan)

  -to manage the profiling of endpoint (e.g. to allow a single type of access and pc tablets, while using the same SSID)

  -I see, creation and management of comments can be easily done from an external program.

  We would like to use ISE, because it seems to have more features, and it's more recent.

  But the big problem is a missing HTTPS API management.

  Can anyone confirm that EHT is not programmable via an external API?

  TIA

  Ivan

  Ivan,

  You are correct in the details you provided above, no support yet on what calls API can be made of a 3rd device of party with regard to the management of users. You will need to touch base with your team account to file a claim on your behalf, I did a quick scan and did not find this listed feature request yet.

  Don't forget that you can deploy NGS 2.0.3 on new equipment 3315 once ISE up to speed you can reimage the box and use the feature comments from the ISE, once you are able to validate all of the features that match your needs.

  Let me know if you have any other questions,

  Tarik