ISE, Windows 7 Machine AuthZ

I'm running on an issue that me was dead in the water on the realization of a roll of ISE for Wireless.  The company has two SSID, an intern and an open, which is essentially an internet conduct only.  No internal resources (other than DHCP and DNS) are available.  We left a SSID inherited using ISE several months ago. Very simple, no BYOD, no registration unit, just Sponsor portal for external notebook computers and the staff for smartphones AD user authentication.  The great work.

The second task was to take a legacy internal SSID and convert it to ISE 1.2.  My thoughts on how to do so, based on the previous experience, the SISE tutorial, "Cisco ISE BYOD and Secure Unified Access" text (which I recommend), and that a couple of consultants, has been to use 802. 1 X to apply computer authentication and user.  Seems simple enough.

Of course, I need this implementation so that it is completely transparent to users.  The legacy SSID is controlled through ad group policy, it seemed a simple matter to change GP, as the new SSID comes at a higher priority.  Users will see both, AD will offer a new, and life goes on.

That's exactly how it is supposed to work, and as far as I can tell, for all cold from laptops, which is exactly what is happening.

See coldstart.png.

Until a user decides to shut down his laptop and standby/hibernation sets.

In case of a night, in the morning, the laptop goes to perform a user authZ but no machine AuthZ.  Because there is no authZ machine, the machine is unable to gain access to the Interior, which is a problem.  In the paper, I see this step:

ISE 24423 was not able to confirm the previous machine successfully authentication of user in Active Directory

In talking with the TAC, they grow I use NAM as begging him, rather than the Native Windows 7 supplicant.  Although I have installed AnyConnect on any computer, cell phone, at the moment, I have configured NAM and that breaks my directive "completely transparent to users.

I also work with Microsoft, and while they have yet to confirm that Windows 7 is just too stupid to understand the situation of the notebook is, I suspect say that soon, as we are running out of things to try on the client.

I am aware of the timer of the re-authentication that exists under the appropriate Authe\orization profile, and this number seems to max out at 18 hours (16-bit).

At present, the I set the timer Reauth in results from politics to 1800 seconds.  I could probably put in a longer time, but weekends that will mess up like a good solution.

About authentication, my default network to ISE strategy, I encouraged PEAP and EAP-FAST.  PEAP is preferred.  PACs are used.  See Defaultaccess.png, Defaultaccess2.png

So, I can't believe I'm the only person with this problem.  Tell your users not to suspend their machines is not an option.  So, I have to ask...  Anyone else able to use 802. 1 X, ISE, Windows 7, as it works with sleep/hibernate?

You're not alone. Making the real machine and the authentication of users (EAP-GETE) is currently not supported by any suppliant natives there. If you notice, the parameters begging Windows 7 allow to define "user or user or machine machine", but not "Machine and User ' is the reason was Cisco's push you the customer NAM. You can view the deployment guide from Cisco for EAP-GETE (a.k.a. EAP-Chaining here):

http://www.Cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_80_eapchaining_deployment.PDF

In addition, a draft RFC for TEAP was already posted:

http://Tools.ietf.org/html/draft-ietf-EMU-EAP-tunnel-method-01

Simply tell your representatives MS and Apple to this topic and request that it be supported in future releases and patches. :)

I don't know enough about your environment, but I suspect that you use MAR (Machine access restrictions). If you use MAR, there is a timer that is set on the tab integration "AD". Once this timer expires ISE removes the database machine mac address, thus preventing the machine to the network until it performs another authentication machine. Unfortunately, this type of machine authentication only happens during a reboot or during a newspaper off / log. There are other associated limits of MAR (see link below) and personally I don't like nor recommend:

http://www.Cisco.com/c/en/us/support/docs/LAN-switching/8021x/116516-problemsolution-technology-00.html

With all that being said, I see the following options:

1 back up the timer MAR to 168 hours (1 week) and have users that they must restart their machines first thing Monday.

2. set Windows supplicants to perform only the PEAP machine authentication. It is different from that of MAR the actual machine AD credentials are used. You will not be able to perform the authentication of the user, but at least you'll only be allowing assets Corp. on the network.

3. implement the Cisco NAM client and perform an EAP-GETE

I hope this helps!

Thank you for evaluating useful messages!

Tags: Cisco Security

Similar Questions

  • Where is the profiles folder that is located on a Windows 8 machine?

    I need to transfer my LOCAL FILES of Thunderbird from a Windows XP machine on a windows 8.1. How to do this?

    Open Thunderbird.
    Press F10, and then select the Help menu
    Click the folder show troubleshooting information.

    OK, so it's the unique to your installation of Thunderbird profile folder.

  • LBP6780dn does not print on Windows 10 machines

    In my small office, we have 6 Macs and 4 windows 10 laptop computers. All Macs have no problem on a new printer Canon LBP6780dn printing. When the Windows 10 machines try to print after you downloaded and installed the drivers from Canon of Canon, it is said

    Loading paper

    LTR

    Labels

    There is paper in the Tray 1 and print portable 4 Windows 8 1/2 x 11 paper, just like the CMA. Once more Macs can print without problem.

    Any suggestions on the activation of Windows to print machines is appreciated.

    FWIW-

    I found that the default paper source was labels. Once I changed the default value of plain, Windows users have been able to print.

  • RDP can connect to a session of console rather than on a Windows XP machine?

    Hello

    I have a Windows Server2003 running of the machine.  I have 3 'stations' running Windows XP SP3, which function as machines of execution to the work initiated by the application on the server. In essence, a repository server where all the jobs are stored and 3 execution servers that run the work at their time. The application (automate BPA Server 8 network Automation) should use the console session (ID 0) to manage the execution of the work.  We would like to use RDP to access servers running, but RDP automatically connects to the console session 0. Is there a way to force the RDP to connect to the console on a Windows XP machine not session?

    Thank you very much for any advice or direction, only you can give me!

    I think that you would probably get a better answer to this question in one of the TechNet forums where they support servers, as I do not have Windows Server 2003 in the House (and probably neither do any of the other people here ), you'll want to check with the server people who have more experience in this sort of thing.

  • can other types of fonts can be installed in the Windows XP machine other than that of True Type Fonts?

    I want to know if any other type of fonts can be installed in the Windows XP machine other than that of True Type Fonts? How many type of Fonta are there? Are there limitations in the number of fonts that can be installed in a system?

    Hello

    I suggest you to refer to this link and check if it helps:

    http://www.Microsoft.com/resources/documentation/Windows/XP/all/proddocs/en-us/windows_fonts_overview.mspx?mfr=true

    It will be useful.

  • I have an acer with SP3 and Windows XP machine. It does not recognize a DVD - RW in my TSST Corp. CD/DVGW TS - L632D

    Original title: DVD problems

    I have an acer with SP3 and Windows XP machine. It does not recognize a DVD - RW in my TSST Corp. CD/DVGW TS - L632D what is the solution. I tried the fix and I also used the Center 'Fix it '.

    Hello

    1 how long have you been faced with this problem?
    2. don't you make changes on the computer before this problem?
    3 are. what patch you referring?
    4. this happens to you with some specific discs?

    Reinstall the drivers for DVD player and check.

    1. click on start > run
    2 type devmgmt.msc and press ENTER. If you are prompted for an administrator password or a confirmation, type the password, or click on allow.
    3. in Device Manager, expand CD-ROM/DVD-ROM drives, right click on the device CD and DVD and then click on uninstall.
    4. When you are prompted to confirm that you want to remove the device, click OK.
    5 restart the computer.
    6. when the computer restarts, the drivers will be installed automatically.

  • Not able to run RealPlayer on the Windows XP machine, the file msvcp90.dll is missing

    Dear Sir / Madam,.

    Pls help advise the question of 'not able to run RealPlayer on Windows XP machine, file msvcp90.dll is missing'?

    Thank you!

    Hi EddieFang,

    Try to download and install real player http://www.real.com.au/.

    I hope this helps.

  • Unable to connect to my new router cable, my XP and Windows 7 machines

    Vista, wireless router Netgear, no link, please help

    No matter what I try, I can't connect to my new router cable, my XP and Windows 7 machines work fine but the Vista laptop are it. Have searched the web, looked at this site and the forums, but nothing does not jump and helps me solve the problem. I use a HP Pavilion DV9000 laptop, all service packs updates and so forth... any ideas?

    I suggest that you contact your ISP and get their help in setting up the Vista machine so it connects properly.  They know the right settings for the access provider, while we do not have and that there may be something else you need to do with Vista which is different of the other two systems (and hopefullly the ISP will also know and be able to talk you through the process).  I call my ISP all the time and they are VERY useful and have ALWAYS resolved any problems, I called (even if sometimes he had a visit from a technician).

    If the ISP Can ' t/don't/can't help you, then after coming back here and we'll try to go through it step by step, even if we cannot have all the information we need.  But I am sure that they will be able to help you more quickly and more effectively and with greater chances of success.

    I hope this helps.

    Good luck!

    Lorien - MCSA/MCSE/network + / has + - if this post solves your problem, please click the 'Mark as answer' or 'Useful' button at the top of this message. Marking a post as answer, or relatively useful, you help others find the answer more quickly.

  • New Windows 7 machine and old printer HP OfficeJet J4580

    I just bought a HP P7 1234 Windows 7 machine.  I plugged my old printer to my vista computer on my new HP machine.  It's a HP Officejet J4580 all-in-One.  Windows find drivers that work, but it did not load the HP Solution Center.

    I loaded the 130.0.44.62 HP Solution Center, but the function 'Add a device' does not see my printer connected to the USB port.

    As you can imagine after that reading the messages here, feeding high things and bottom, connection and disconnection of the devices is not work or help.  I can't not work printer from the HP Solution Center scan functions.  I am a loyal customer of HP, but it shouldn't be rocket science.  If there is no patch from HP that will make my HP Solution Center see my printer, or if not, there are only a few easy steps to solve this problem, can you recommend a current HP printer all in one for about $100 that will load and play as announced?

    Chris hoping he doesn't have to cut, delete, load and restart, load and restart, ad nauseam.

    Hello

    That's why I called many products such as Plug-n-Paray products (with many suppliers). In this case, please visit the following site to download the drivers for it and install them on your new computer.

    http://h10025.www1.HP.com/ewfrf/wc/softwareCategory?OS=4062&LC=en&cc=us&DLC=en&sw_lang=&product=3645100

    Kind regards.

  • Windows 7 asked to "enter network password" when you access the window XP Machine

    Hi all

    I have one two PC with Windows XP Pro & the other with Windows 7 Pro. I've implemented a network & it seems to work but when I try to access my XP Machine from Windows 7 to ask me to enter the network password. I tried to enter my password to login & that did not work, I tried to disable the password for the xp machine and he asks again. What can I do to solve this problem. My xp machine I can access the pc windows 7 very well so I do not understand why this network password W7.

    Did some research on the net and here's what I did to solve the problem that has been produced

    Allowing access to the network without password

    To allow users to log on to their computer without password and then access the XP Professional machine without a password, you must make a change security policy:

    1. Go to Control Panel | Performance and Maintenance | Administrative Tools | Local security policy.
    2. Expand local policies | Security options.
    3. Double-click on accounts: limit local account passwords using empty for the connection to the console only, which is enabled by default. Disable this option and click OK.

    It stopped at the dialog box access network appearing when trying to access my windows xp machine 7!

  • Can't access files shared from the Windows 7 machine "you don't have permission to access to...» »

    I have a windows XP Dell, who owns a record of Quickbooks on it.  I have always shared this folder between two XP machines.  I upgraded a computer to Windows 7.  The Windows 7 machine can see the XP machine, see the shared file, but gets an error that says...

    Windows cannot access \\HOLLYS-PC\Intuit

    You are not allowed to access \\HOLLYS-PC\\Intuit. Contact your network administrator to request access.

    I followed the instructions on both machines to share files AND have no RESIDENTIAL unit located on the machine 7.

    Hello

    See this link for more information on how to share files:

    http://social.answers.Microsoft.com/forums/en/w7network/thread/14c9cf97-ac52-48bc-A730-284de284d353

    http://Windows.Microsoft.com/en-us/Windows7/file-sharing-essentials

    http://www.howtogeek.com/HOWTO/Windows-7/share-files-and-printers-between-Windows-7-and-XP/

    http://Windows.Microsoft.com/en-us/Windows7/why-can-t-I-connect-to-other-computers

    I hope this helps.

  • How to use the windows fax machine and how to open an administrator account?

    How use the windows fax machine, and how can I open an administrator account?

    Original title: activateadministratoraccount

    Hello

    Thanks for your posting in the Microsoft community

    Well, you can enable the administrator account hidden instead of an account

    You can make the win + r and write lusrmgr.msc in the start search box or in the command run and pressing ENTER. Or, you could open the computer by right clicking on computer management in the start menu and select manage.

    Expand System Tools > local users and groups > users.

    Right-click the administrator account, and then select "Set password".

    In the 'set password' click 'continue '.

    In the "set password" enter the password of the administrator twice, then click on 'Ok '.

    Then, activate the administrator account. Right click on the administrator account and select "Properties".

    n check the box "account is disabled". Click on the Ok"" button.

  • Getting a 0x800704b3 error Code when you try to access WIndows 7 machine from Windows 8 machine records

    I just bought a new all-in-one PC of Windows 8 at my local store from Microsoft and configure it to my client.  They have a Windows 7 Pro machine, which I connected to via homegroup.  I tried to access the actions of the Windows 8 machine as well as access to the C: drive on the Windows 7 machine.  For some reason, he sees the actions and invites you to me for a user name and password to connect to the machine.  I enter the correct credentials and it keeps kicking back this error code.  I need to access the computer Windows 7 Windows 8 machine, so any help would be greatly appreciated.

    Thanks for your answer in advance!

    -Eddie

    Hi Eddie,.

    Follow the links and check:

    http://answers.Microsoft.com/en-us/Windows/Forum/Windows_7-networking/win-764-ultimate-backup-restore-gives-this-error/542da2e6-CD36-4677-B194-fd5b409f81af

    http://answers.Microsoft.com/en-us/Windows/Forum/Windows_7-windows_install/error-code-0x800704b3/2c4433fa-3eAd-4c8a-865e-c9ff72391c14

    http://social.technet.Microsoft.com/forums/en-us/w7itprosecurity/thread/1aed9095-0495-4ef6-94aa-8e00067bec76

    http://social.technet.Microsoft.com/forums/en-us/w7itprogeneral/thread/55e914fc-7ff2-440A-9d14-13ccceeb756c

  • How to upgrade to Windows Live Mail 2012 (Windows 8 machine)?

    Original title: windows live mail 2012

    How to upgrade to Windows Live Mail 2012 (Windows 8 machine)?  My Windows 7 computer is Windows Live Mail 2011, which is much better than 2012.  Is there a Windows Live Mail 2013 - 2014 that I can upgrade to?  I hope the update will have more options to setup email (ie: showing "sender" before "subject".)

    No, unfortunately Windows Live 2012 is the latest version of Windows Live.

    See you soon!

  • Export a LR catalog of my Macbook Pro to Windows 10 machine

    Is it possible to export a LR catalog of my Macbook Pro to Windows 10 machine without any problem?

    Yes. I'm doing exactly this. Here's a helpful video:

    How to use Lightroom 5 on location | The complete picture with Julieanne Kost. Adobe TV

Maybe you are looking for