Cisco Ise 13 User Guide

Full NameAbbreviated NameIDLanguage
Finnishfi1035Finnish
Frenchfr1036French
French-Canadianfr-ca3084FrenchCanadian
Germande1031German
Hungarianhu1038Hungarian
Italianit1040Italian
Japaneseja1041Japanese
Korean(ExtendedWansung)ko1042Korean
Norwegianno1044Norwegian
Polishpl1045Polish
Portuguesept2070Portuguese
Russianru1049Russian
Serbian(Latin)sr2074SerbianLatin
Serbian(Cyrillic)src3098SerbianCyrillic
Spanish(Traditional)es1034Spanish
Swedishsv1053Swedish
Turkishtr1055Turkish
Client IP Address Refresh...

Usage GuidelinesMode (Applies only to
Cisco NAC Agent)
Default ValueField
Thissettingisthe
intervalatwhichthe
agentcheckforthe
VLANchange.
FortheWindows
NACagent,the
defaultvalueis0.
Bydefault,the
accessto
authentication
VLANchange
featureisdisabled
forWindows.The
validrangeis0to5
seconds.
FortheMacOSX
agent,thedefault
valueis5.By
default,theaccess
toauthentication
VLANchange
featureisenabled
with
VlanDetectInteval
as5secondsfor
MacOSX.The
validrangeis5to
900seconds.
0—Accessto
Authentication
VLANchange...

Usage GuidelinesMode (Applies only to
Cisco NAC Agent)
Default ValueField
Thissettingenables
ordisablesVLAN
detectionevenwhen
theuserisnot
loggedin.
No—VLANdetect
featureisdisabled.
Yes—VLANdetect
featureisenabled.
MergeNoEnableVLANdetection
withoutUI(Notapplicable
foraMacOSXclient)
IftheInternet
ControlMessage
Protocol(ICMP)or
AddressResolution
Protocol(ARP)
pollingfails,this
settingconfigures
theagenttoretryx
timesbefore
refreshingtheclient
IPaddress.
Merge3Retrydetectioncount
Thissetting...

Usage GuidelinesMode (Applies only to
Cisco NAC Agent)
Default ValueField
Thissetting
specifieswhetheror
nottheclient
machinetorenewor
refreshitsIP
addressafterthe
switch(orWLC)
changestheVLAN
fortheloginsession
oftheclientonthe
respectiveswitch
port.
OverwriteYes(Default)EnableagentIPrefresh
Thissetting
specifiesthatthe
clientmachinewaits
beforeattemptingto
requestforanewIP
addressfromthe
networkDHCP
server.
Overwrite0
Thevalidrangeis0to60
seconds.
DHCPrenewdelay
Thesettingspecifies
thattheclient...

Usage GuidelinesModeValueField
Ifthevalueissetto
No,thissettingturns
offcheckingthe
certificaterevocation
list(CRL)during
discoveryand
negotiation.
OverwriteYesAllowCRLChecks
(Notapplicablefora
MacOSXclient)
Ifyouspecifyoneor
moreMACaddresses
inthssetting,theagent
doesnotadvertise
thoseMACaddresses
toCiscoISEduring
loginand
authenticationtohelp
preventsending
unnecessaryMAC
addressesoverth
network.
MergeEnterMACaddresses
separatedbyacomma.
Forexample,
AA:BB:CC:DD:EE:FF,
11:22:33:44:55:66
MACAddress...

Usage GuidelinesModeValueField
Thisfieldconsistsof
comma-separated
namesofassociated
CiscoISEservers.The
agentusesthenames
inthislisttoauthorize
CiscoISEaccess
points.Ifthislistis
empty,then
authorizationisnot
performed.ifanyof
thenamesisnotfound,
thenanerroris
reported.
MergeEnterthefully
qualifieddomainname
(FQDN)oftheCisco
ISEserverthatare
separatedbyacomma.
ServerNameRules
Thissettingsupports
Evolution-Data
Optimizedconnectson
theclientmachine.if
theclientmachine
doesnothavean
activenetwork...

Usage GuidelinesModeValueField
Ifthissettingissetto
Yes,theagentdisables
theabilitytoincrease
thetransmission
intervalforLayer3
discoverypackets.
Therefore,theLayer3
discoverypackets
repeatedlygoout
every5seconds,just
likeLayer2packets.
MergeNoDisableL3SWISS
delay(Notapplicable
foraMacOSXclient)
Thissettingspecifies
theHTTPdiscovery
timeoutforwhichthe
HTTPSdiscovery
fromtheagentwaits
forthediscovery
responsefromCisco
ISE.ifthereisno
responseforthe
specifiedtime,then
thediscoveryprocess
timesout....

Usage GuidelinesModeValueField
Thissettingspecifies
theHTTPtimeoutfor
whichtheHTTP
requestfromtheagent
waitsfortheresponse.
ifthereisnoresponse
forthespecifiedtime,
thentherequesttimes
out,andthediscovery
processtimesout.
Ifthevalueissetto0,
thenthedefaultclient
machineoperating
systemtimeout
settingsareused.
Ifthevalueissetto1
or2,automaticallythe
valueissetto3.
Merge120(Defaultfor
Windowsclients)
Thevalidrangeis3
secondsandabove.
HTTPTimeout(Not
applicableforaMac
OSXclient)
Client Login Session...

Posture Agent Download Issues
Rememberthatdownloadingthepostureagentinstallerrequiresthefollowing:
•TheusermustallowtheActiveXinstallerinthebrowsersessionthefirsttimeanagentisinstalledon
theclientmachine.(Theclientprovisioningdownloadpagepromptsforthis.)
•TheclientmachinemusthaveInternetaccess.
Resolution
•EnsurethataclientprovisioningpolicyexistsinCiscoISE.Ifyes,verifythepolicyidentitygroup,
conditions,andtypeofagent(s)definedinthepolicy.(Alsoensurewhetherornotthereisanyagent...

(The/qnqualifierinstallstheCiscoNACAgentcompletelysilently.The/l*vlogstheinstallationsessionin
verbosemode.)
TouninstalltheNACAgent,youcanexecutethefollowingcommand:
msiexec/xNACAgentSetup-win-.msi/qn
InstallinganewversionoftheAgentusingMSIwilluninstalltheoldversionandinstallthenewversion
usingtheabovecommands.
Step 5IfyouareusingAltiris/SMStodistributetheMSIinstaller,placetheAgentcustomizationfilesinasub-directory
named“brand”inthedirectory“%TEMP%/CCAA”.WhentheCiscoNACAgentisinstalledintheclient,the...