Security CCIE Blog

Cisco ISE publishes its SGT-to-IP (SXP) bindings through the pxGrid REST API. The getBindings call is a POST with an empty JSON body and requires a client certificate, so many tools, such as firewalls with external feeds, scripts and dashboards, cannot consume it directly. An…

In this post, I'll detail the configuration for Netscaler ADC Load Balancer when it's deployed for the purposes of load balancing multiple ISE nodes There's already a great post by Brad Johnson available here: https://community.cisco.com/t5/security-knowledge-base/citrix-netscaler-cli-configuration-for-cisco-ise-radius-and/ta-p/4679861. I will expand on that configuration and add screenshots on…

It is very common for customers to place a set of ASA firewalls for remote access behind a single DNS entry. Specifically, Cisco Secure Client (Anyconnect) client on the users' computers are configured to connect to a single URL and that URL resolves to external…

Many companies are shifting their workloads to the cloud and it’s important to deploy a level of segmentation to protect from Internet threats as well as Internal. Cisco has a next-generation firewall that has a perfect fit to handle this requirement. Starting with version 7.3,…

Many companies are shifting their workloads to the cloud and it's important to deploy a level of segmentation to protect from Internet threats as well as Internal. Cisco has a next-generation firewall that has a perfect fit to handle this requirement. Starting with version 7.2,…

Many security best practices discourage using corporate credentials such as Active Directory for connecting to wireless network. In this post, I'll demonstrate just how easy it is for an attacker to capture iPhone user corporate credentials in clear text using GTC downgrade attack There are…

I speak to many Cisco ISE customers and a lot of them are moving to Intune as their MDM platform. ISE has a robust integration with Intune which is documented in a few different documents. I wanted to put this document together that shows the…

When working with RADIUS products such as Cisco ISE, we frequently need to test authentication to validate that our policies are working. The obvious method to perform this testing is to stand up a network device such as a Wireless Controller, Switch or a VPN…

In my first post, I'll walk through configuration of Terraform and Ansible to fully automate deployment and configuration of ISE nodes behind an F5 Load Balancer with just one command. We will use AWS for this configuration. I plan to add a similar document for…