Probe BEAM on to ISE WLC

Similar Questions

• ISE & WLC

  Small question:

  If I deploy ISE + WLC wlc is located in HREAP / Flexconnect mode, access lists doesn't not work, how am I supposed to remote locations, customers of posture?

  [(cuz j'allais mettre une ACL pour bloquer tout mais dns/etc jusqu'à ce qu'ils obtenir àle pâturage)]

  Can I change VLAN depending on user/device once they have hit the AP? I always talk about distant places?

  Edon,

  Here's a flex connects characteristic matrix, this support with ise 1.1 (since there is a section dedicated to him.). You will need to move to 7.2 to get the new features.

  http://www.Cisco.com/en/us/products/ps10315/products_tech_note09186a0080b3690b.shtml

  	WAN upward (switching Center)	WAN upward (local switching)	WAN down (independent)

  ISE 1.1

  Yes

  Yes (7.2.110.0)

  NO.

  Release notes for 7.2 (http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7_2.html#wp855314)

  I hope this helps.

  Tarik Admani
  * Please note the useful messages *.

• WLC (foreign-anchor), problem with external web authentication-> ISE

  Hello guys

  I am designing a platform for a network of comments, which must be isolated from the LAN, the following facilities:

  • ISE 1.2 (SNS-3415-K9 Cisco)
  • WLC 7.0.230.0 (Cisco 5508 controller)---> foreign wlc
  • WLC 7.0.230.0 (Cisco 5508 controller)---> wlc anchor.

  The PAES tunnel between wlc is successfully completed.

  The wireless client gets the IP address of the anchor wlc (DHCP server).

  Test 1:

  I have set up the ANCHOR WLC with local web authentication (internal), the wireless client is authenticated by WLC and successfully navigate.

  Test 2:

  Configure the authentication web external anchor (ISE) WLC. Configure a user to the portal comments ISE.

  The wireless client gets the IP address of the anchor wlc (DHCP server), attempting to engage not display comments portal.

  Debugging a wireless client, try to connect to the guest network is attached.

  That's right... they have a version of code required minimum supported for this.

  Thank you

  Scott

  Help others using the system of rating and marking answers questions like "answered."

• Guest access with ISE and WLC LWA

  Hi guys,.

  Our company try to implement access as guest with dan ISE WLC with the local Web authentication method. But there is problem that comes with the certificate. This is the scenario:

  1. the clients are trying to connect wifi with guest SSID

  2. once it connects, you can open the browser and try to open a Web page (example: cisco.com)

  3, because guests didn't connect, so this link redirect to "ISE Guest Login Page" (become): url

  https://ISE-hostname:8443/guestportal/login.action?switch_url= https://1.1.1.1/login.html&wlan=Guest&redirect=www.cisco.com/

  )

  4. If there is no Login to ISE not installed comments Page, no reliable connection of message message, but it will be fine is they "Add Exception and install the certificate".

  

  5. once the Guest Login Page will appear and you can enter their username and password.

  

  6 connection success and they will be redirected to www.cisco.com and there pop-up 1.1.1.1 (IP of the Virtual Interface WLC) with the logout button.

  The problem occur in scenario 6, after the success of the opening session, the Web page with the address and the error of certificate ISE IP to 1.1.1.1 is appear.

  

  I know that it happened when you can has no Page of Login of WLC certificate...

  My Question is, is there a way of tunneling WLC certificate to EHT? Or what we can do for ISE validate certificate WLC, invited didn't need to install the certificate WLC / root certificate before you connect to the Wifi?

  THX 4 your answer and sorry for my bad English...

  Do not mix WLC with ISE comments Portal local Web authentication. Choose one or the other. I suggest the portal + WLC CWA.

• ISE 1.4 and Apple 'captive Network Assistant"causing problems

  I'm testing ISE 1.4 with 10.10.2/Safari 8.0.3 MAC and the boring revised downward Safari AKA "Captive Network Assistant" gets in the way.  I wonder what other people did to work around.

  According to the compatibility of network component Cisco ISE v1.4 Safari I must be compatible, in captivity Network Assistant says that this isn't, but I suspect its because the computer MAC laptop try to validate with ~ 200 areas (so I hear for this).  My ISE/WLC have a DACL that allows certain IP addresses before finishing the AuthC/Z, and obviously I can't put in the DACL for all 200 of these areas.  My ISE is configured with trustsec model where I have two SSID, a first on the front-end to detect if Anyconnect 4.x is installed and if it is not then redirect to a portal.  Fails it MAC peripheral security check cause... or should I say will not display it. cause Apple Network Assistant captive.

  I know I can disable the captive Network Wizard by renaming the file, but it will probably not an acceptable solution in my environment for political reasons.  I wonder what others have done to bypass this annoying problem.  Maybe something with a DNS record or something...

  Thank you

  e-

  Common recommendation is to deceive the apple devices to think he has access to the internet by running this command on the command-line of your WLC:

  config network web-auth captive-bypass enable

• Create multiple SSID - WLC - ISE 1.4 comments

  Hello

  I wonder if there is a way to create several comments about WLC SSID with specify policy on ISE 1.4?

  I tried to create 2 comments SSID with 2 policies. The point is that it is the first policy that matches any SSID.

  Any idea?

  Concerning

  Eric

  Add airespace-wlan-id to your strategy on the ISE, ISE will use the WLAN-id to match the correct strategy

• ISE with WLC AND switches

  Hello

  We run 3xWLC controller with 800 AP using ISE 1.2 for authentication wireless 802. 1 x. I was looking in the config of the ISE and notice of 400 edge cheating only 2x2960s are configured with 802. 1 x (ISE RADIUS config) and SNMP and only 2 of the port is 2 ap tie with swtich remaining ports.and the 3XWLC in network devices.

  I do not understand how an access point is to do this work (802.1 x) because it is location on different site and people are connecting to various different locations. ISE almost run/do 11 876 profiled ends.

  version 12.2
  !
  boot-start-marker
  boot-end-marker
  !
  enable secret 5 $1$ fokm$ lesIWAaceFFs.SpNdJi7t.
  !
  Test-RADIUS username password 7 07233544471A1C5445415F
  AAA new-model
  Group AAA dot1x default authentication RADIUS
  Group AAA authorization network default RADIUS
  Group AAA authorization auth-proxy default RADIUS
  start-stop radius group AAA accounting dot1x default
  start-stop radius group AAA accounting system by default
  !
  !
  !
  !
  AAA server RADIUS Dynamics-author
  Client 10.178.5.152 server-key 7 151E1F040D392E
  Client 10.178.5.153 server-key 7 060A1B29455D0C
  !
  AAA - the id of the joint session
  switch 1 supply ws-c2960s-48 i/s-l
  cooldown critical authentication 1000
  !
  !
  IP dhcp snooping vlan 29,320,401
  no ip dhcp snooping option information
  IP dhcp snooping
  no ip domain-lookup
  analysis of IP device
  !
  logging of the EMP
  !
  Crypto pki trustpoint TP-self-signed-364377856
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 364377856
  revocation checking no
  rsakeypair TP-self-signed-364377856
  !
  !
  TP-self-signed-364377856 crypto pki certificate chain
  certificate self-signed 01
  30820247 308201B 0 A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030
  2 060355 04031325 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 30312E30
  69666963 33363433 37373835 36301E17 393330 33303130 30303331 0D 6174652D
  305A170D 2E302C06 1325494F 03550403 32303031 30313030 30303030 5A 303031
  532D 5365 6C662D53 69676E65 642D 4365 72746966 69636174 652 3336 34333737
  06092A 86 4886F70D 01010105 38353630 819F300D 00308189 02818100 0003818D
  B09F8205 9DD44616 858B1F49 A27F94E4 9E9C3504 F56E18EB 6D1A1309 15C20A3D
  31FCE168 5A8C610B 7F77E7FC D9AD3856 E4BABDD1 DFB28F54 6C24229D 97756ED4
  975E2222 939CF878 48D7F894 618279CF 2F9C4AD5 4008AFBB 19733DDB 92BDF73E
  B43E0071 C7DC51C6 B9A43C6A FF035C63 B53E26E2 C0522D40 3F850F0B 734DADED
  02030100 01A 37130 03551 D 13 6F300F06 0101FF04 05300301 01FF301C 0603551D
  11041530 13821150 5F494D2B 545F5374 61636B5F 322D312E 301F0603 551D 2304
  18301680 1456F3D9 23759254 57BA0966 7C6C3A71 FFF07CE0 A2301D06 03551D0E
  04160414 56F3D923 75925457 BA09667C 6C3A71FF F07CE0A2 2A 864886 300 D 0609
  F70D0101 5B1CA52E B38AC231 E45F3AF6 12764661 04050003 81810062 819657B 5
  F08D258E EAA2762F F90FBB7F F6E3AA8C 3EE98DB0 842E82E2 F88E60E0 80C1CF27
  DE9D9AC7 04649AEA 51C49BD7 7BCE9C5A 67093FB5 09495971 926542 4 5A7C7022
  8D9A8C2B 794D99B2 3B92B936 526216E0 79 D 80425 12B 33847 30F9A3F6 9CAC4D3C
  7C96AA15 CC4CC1C0 5FAD3B
  quit smoking
  control-dot1x system-auth
  dot1x critical eapol
  !
  pvst spanning-tree mode
  spanning tree extend id-system
  No vlan spanning tree 294-312,314-319,321-335,337-345,400,480,484-493,499,950
  !
  !
  !
  errdisable recovery cause Uni-directional
  errdisable recovery cause bpduguard
  errdisable recovery cause of security breach
  errdisable recovery cause channel-misconfig (STP)
  errdisable recovery cause pagp-flap
  errdisable recovery cause dtp-flap
  errdisable recovery cause link-flap
  errdisable recovery cause FPS-config-incompatibility
  errdisable recovery cause gbic-invalid
  errdisable recovery cause psecure-violation
  errdisable cause of port-mode-failure recovery
  errdisable recovery cause dhcp-rate-limit
  errdisable recovery cause pppoe-AI-rate-limit
  errdisable recovery cause mac-limit
  errdisable recovery cause vmps
  errdisable recovery cause storm-control
  errdisable recovery cause inline-power
  errdisable recovery cause arp-inspection
  errdisable recovery cause loopback
  errdisable recovery cause small-frame
  errdisable recovery cause psp
  !
  internal allocation policy of VLAN ascendant
  !
  !
  interface GigabitEthernet1/0/10
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  interface GigabitEthernet1/0/16
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
   
  interface GigabitEthernet1/0/24
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
   
  !
  interface GigabitEthernet1/0/33
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
   
  interface GigabitEthernet1/0/34
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface GigabitEthernet1/0/44
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  !
  interface GigabitEthernet1/0/46
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard

  interface GigabitEthernet1/0/48
  switchport access vlan 320
  switchport mode access
  IP access-group ACL-LEAVE in
  authentication event fail following action method
  action of death server to authenticate the event permit
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  open authentication
  authentication order dot1x mab
  authentication priority dot1x mab
  Auto control of the port of authentication
  periodic authentication
  authentication violation replace
  MAB
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  spanning tree enable bpduguard
  !
  interface GigabitEthernet1/0/49
  Description link GH
  switchport trunk allowed vlan 1,2,320,350,351,401
  switchport mode trunk
  MLS qos trust dscp
  IP dhcp snooping trust
  !

  interface GigabitEthernet1/0/52
  Description link CORE1
  switchport trunk allowed vlan 1,2,29,277,278,314,320,401
  switchport mode trunk
  MLS qos trust dscp
  IP dhcp snooping trust
  !
  !
  interface Vlan320
  IP 10.178.61.5 255.255.255.128
  no ip-cache cef route
  no ip route cache
  !
  default IP gateway - 10.178.61.1
  IP http server
  IP http secure server
  IP http secure-active-session-modules no
  active session modules IP http no
  !
  !
  Access IP extended ACL-AGENT-REDIRECT list
  deny udp any any domain eq bootps
  permit tcp any any eq www
  permit any any eq 443 tcp
  IP extended ACL-ALLOW access list
  allow an ip
  IP access-list extended by DEFAULT ACL
  allow udp any eq bootpc any eq bootps
  allow udp any any eq field
  allow icmp a whole
  allow any host 10.178.5.152 eq 8443 tcp
  permit tcp any host 10.178.5.152 eq 8905
  allow any host 10.178.5.152 eq 8905 udp
  permit tcp any host 10.178.5.152 eq 8906
  allow any host 10.178.5.152 eq 8906 udp
  allow any host 10.178.5.152 eq 8909 tcp
  allow any host 10.178.5.152 eq 8909 udp
  allow any host 10.178.5.153 eq 8443 tcp
  permit tcp any host 10.178.5.153 eq 8905
  allow any host 10.178.5.153 eq 8905 udp
  permit tcp any host 10.178.5.153 eq 8906
  allow any host 10.178.5.153 eq 8906 udp
  allow any host 10.178.5.153 eq 8909 tcp
  allow any host 10.178.5.153 eq 8909 udp
  refuse an entire ip
  Access IP extended ACL-WEBAUTH-REDIRECT list
  deny ip any host 10.178.5.152
  deny ip any host 10.178.5.153
  permit tcp any any eq www
  permit any any eq 443 tcp

  radius of the IP source-interface Vlan320
  exploitation forest esm config
  logging trap alerts
  logging Source ip id
  connection interface-source Vlan320
  record 192.168.6.31
  host 10.178.5.150 record transport udp port 20514
  host 10.178.5.151 record transport udp port 20514
  access-list 10 permit 10.178.5.117
  access-list 10 permit 10.178.61.100
  Server SNMP engineID local 800000090300000A8AF5F181
  SNMP - server RO W143L355 community
  w143l355 RW SNMP-server community
  SNMP-Server RO community lthpublic
  SNMP-Server RO community lthise
  Server SNMP trap-source Vlan320
  Server SNMP informed source-interface Vlan320
  Server enable SNMP traps snmp authentication linkdown, linkup cold start
  SNMP-Server enable traps cluster
  config SNMP-server enable traps
  entity of traps activate SNMP Server
  Server enable SNMP traps ipsla
  Server enable SNMP traps syslog
  Server enable SNMP traps vtp
  SNMP Server enable traps mac-notification change move threshold
  Server SNMP enable traps belonging to a vlan
  SNMP-server host 10.178.5.152 version 2 c lthise mac-notification
  SNMP-server host 10.178.5.153 version 2 c lthise mac-notification
  !
  RADIUS attribute 6 sur-pour-login-auth server
  Server RADIUS attribute 8 include-in-access-req
  RADIUS attribute 25-application access server include
  dead-criteria 5 tent 3 times RADIUS server
  test the server RADIUS host 10.178.5.152 auth-port 1812 acct-port 1813 username test-RADIUS 7 key 03084F030F1C24
  test the server RADIUS host 10.178.5.153 auth-port 1812 acct-port 1813 username test-RADIUS 7 key 141B060305172F
  RADIUS vsa server send accounting
  RADIUS vsa server send authentication

  any help would be really appreciated.

  I'm not sure that completely understand the question; But if LSE is only political wireless, then none of the wired switches need any configuration of ISE.

  Access points tunnel all wireless traffic to the WLC on CAPWAP (unless you use FlexConnect). This is the configuration 802. 1 x on the WLC that implements policies defined in ISE.

  Switches wired never need to act as an access network (n) device and so do not need to be defined in ISE unless or until you want to apply policies of ISE for wired devices...

• Cisco ISE 2.0 and WLC 5508 with 7.6.130.0

  I have looked on the release notes and compatibility n for ISE 2.0 and have not seen the answer to that. For the WLC 5508, the minimum AirOS is 7.0.116.0 but he limited the AAA authentication and support for comments. The recommended version of AirOS is 8.0.121.0.

  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/2-0/compatibility/ISE _...

  What airos 7.6.130.0? I know that AirOS release works with 1.3 and 1.4, even if they show the same support for version 2.0. I'm just afraid that something may have changed with 2.0. I am concerned only about the AAA authentication and guest access. No BYOD, posture or MDM is necessary.

  No change. Works well.

• ISE foreign CWA / deployment WLC - missing user of anchor names

  I'm not sure if this belongs to the section mobility or security - I'll just give it a try here.
  I've set up wireless access visitor with Cisco ISE 1.3 (patch 2) and a stranger WLC / anchor of deployment (7.6.130.0).
  So far almost everything works fine - but I probably have a problem with logging Cisco ISE.

  In exploitation forest 'authentications Live', I see the authentication successful, but the identity of the column, it shows just the MAC address of endpoint.
  If navigation to the identity store of endpoint endpoint of comments is in the right group (guestendpoints) and when you look at the details of the endpoint, I can see the "portalusername" who created the user.

  If I click on endpoints active view (see attachment), I can see all active clients (Authz profile "PermitAccess"). I guess the user name of the client must be filled out there as well, no?

  endpoint_view.PNG

  

  Someone has an idea what is the cause for this? Or is the normal behavior?

  My rules of authentication are:
  If "wireless_mab" and "RADIUS: Called-Station-ID ENDS WITH comments-SSID" then use "endpoints internal" and continue if "user not found".

  My authorization rules are:
  1.) if GuestEndpoints AND (Wireless_MAB AND RADIUS: Called-Station-ID ENDS_WITH Guest SSID) then PermitAccess
  2.) if (Wireless_MAB AND RADIUS: Called-Station-ID ENDS_WITH Guest SSID) then GUEST_WEBAUTH
  The profile GUEST_WEBAUTH Authz defined the CWA and preauthentication ACL for the WLC

  The WLC I just configured the WLC foreign with the RADIUS (ISE) server and active authentication MAC the SSID.
  All parameters such as aaa-override and RADIUS of the NAC are defined. The defined RADIUS is set on "settler" to comply with the ISE

  According to my experience, this is the expected behavior.  The new workflow for the use case of comments starting at the point 1.3 of the ISE typically includes registration of endpoint, you're.  Your strategy for authz for post-portail of authentication (after the certificate of authenticity) needs the MAC address to use as the identity for permissions invited, not the guest credentials used on the portal.

  That being said, I would like to be able to see the username of the user portal whenever a registered endpoint point authenticates (until it is served using endpoint political purges, of course).

  Tim

• ISE 1.4 compatible with WLC 5508 version 7.6.130.0 and 8.0.115.0

  Hi Expert,

  We check in on Cisco ISE 1.4 online document below we found this case WLC 5508 version 7.6.130 support
  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/1-4/compatibility/ISE _...

  But as control with Cisco WLC5508 version 7.6.130.0 version found takes in charge only ISE 1.2
  http://www.Cisco.com/c/en/us/TD/docs/wireless/controller/release/notes/c...

  And for WLC 8.0.115.0 show support ISE1.3
  http://www.Cisco.com/c/en/us/TD/docs/wireless/controller/release/notes/c...

  But on the compatibility matrix Wireless show that the version ISE1.3
  http://www.Cisco.com/c/en/us/TD/docs/wireless/compatibility/matrix/Compa...

  We want to know what the WLC version 7.6.130.0 and 8.0.115.0 can support ISE 1.4 or not?

  See you soon,.

  FN

  Yes, they both work with ISE 1.2, 1.3 and 1.4, it's probably just the case of this version specific WLC has been tested with the ISE version that was going out at the time.

• new redirect URL of ISE 1.3 for WLC (Webauth external URL)

  Hello

  Could someone tell me the URL of ISE 1.3 for WLC?

  ISE1.2 was:

  https://ISE-1.Cisco.local:8443/guestportal/login.action

  Yes, the structure has been changed since version 1.2, and I did bother understand since there is now a button 'Portal test URL. Have you tried? Or do you still need to be able to manually browse for it?

  If you still need search manually it then you can use the test button to get the URL and then save it :)

  Thank you for evaluating useful messages!

• That is the accounting Radius WLC in distributed deployment of ISE server, this is the PSN or MnT node

  Hello

  on the WLC configuration for Management Server accounts Radius in distributed deployment of ISE, what server is the radius, the Service account management policy one or several nodes or the nodes in control?

  As always, appreciate your reply.

  Mike

  Hi Mike,.

  The WLC must be configured to send authentication and accounting for the PSN. Monitoring nodes are (among other functions) where newspapers PSN are transmitted to the.

  see you soon,

  SEB.

• Duplication of attribute ISE Probe

  I'm curious to know what is the logic in point 1.3 of the ISE, when more than one probe various information of the termination report. Say endpoint with a MAC address has identified, and then he gets two different IP addresses for the same MAC DHCP probe and maybe probe cache SNMP CDP? Which he will prefer? It seems that maybe need this exact last updated received irrespective of the probe, probe?

  Customization attributes are constantly collected and stored in the database of the ISE. An attributed is not preferred on the other. Instead, they are profiling rules that decide how a device profile. Specifically, rules of profiling with higher certainty factor are preferred over others. For example, a device is emerging as a 'phone Cisco' with a CF = 10. Later, other attributes are collected, and ISE has now enough information to match a rule of profiling for Cisco-IP-Phone-7945 with FC = 30. As a result, the device will be that we present to you as a Cisco IP Phone 7945.

  I hope this helps!

  Thank you for evaluating useful messages!

• Cisco ISE and WLC Access-List Design/scalability

  Hello

  I have a scenario that wireless clients are authenticated by the ISE and different ACL is applied depending on the rules in the ISE. The problem I have seen is due to the limitation on the Cisco WLC that limit only 64 input access list. As the installer has only a few IVR/interfaces and several different access lists are applied to the same base on user groups interface; I was wondering if there may be an evolutionary design / approach according to which the access list entries can evolve next to create a vlan for each group of users and apply the access list on the interface of layer 3 instead? I illustrated the configuration below for reference:

  Group of users 1 - apply ACL 1 - on Vlan 1

  User 2 group - apply ACL 2 - on the Vlan 1

  3 user group - apply ACL 3 - on the Vlan 1

  The problem appears only for wireless users, he does not see on wired users as the ACLs can be applied successfully without restriction as to the switches.

  Any suggestion is appreciated.

  Thank you.

  In fact, you have limitations on the side of the switch as well. Long ACL can deplete resources AAGR of the switch. Take a look at this link:

  http://www.Cisco.com/c/en/us/support/docs/switches/Catalyst-3750-series-switches/68461-high-CPU-utilization-cat3750.html

  The new WLCs based on IOS XE and not the old OS Wireless/Aironet will provide the best experience in these matters.

  Overall, I see three ways to overcome your current number:

  1. reduce the ACL by making them less specific

  2 use L3 interfaces on a switch L3 or FW and the ACL is applied to them

  3. use the SGT/SGA

  I hope this helps!

  Thank you for evaluating useful messages!

• Cisco ISE 1.2 & Cisco WLC 5508 v7.6

  Hi all

  We intend to upgrade our WLC to 7.6 to fix a bug with FlexConnect customer ACL but I just saw on the ISE Cisco compatibility table which it recommended only up to the WLC 5508 v7.5...

  Cisco told me to avoid 7.5 as it is in a State of defferred if anyone know or are running in a laboratory or production, ISE1.2 with a WLC v7.6 n 5508?

  I wish I knew rather questions of people know before hand than to have to go through a software update, and then restore.

  Thank you all

  Mario Rosa

  Definitely stay away from 7.5. I've done several deployments with the WLCs 7.6 running. The two main issues that I touched were:

  CSCue68065 - in this bug FlexConnect ACL does not work unless you have a regular (non FlexConnect) ACL created with exactly the same name

  CSCuo39416 - CWA does not not on FlexConnect APs. It would apply to you if you have older models APs

  I hope this helps!

  Thank you for evaluating useful messages!