Posts

Showing posts from January, 2026

Cisco ISE Guest Portals with Ruckus SmartZone

Image
Ruckus SmartZone 7.0 and later support a new RADIUS VSA (Vendor Specific Attribute) for dynamic URL redirection. This means that Cisco ISE can integrate with SmartZone Controllers just like Cisco WLCs and Meraki APs.  The ISE built-in RuckusWireless NAD profile must be duplicated and modified to use Ruckus-External-Url VSA for the $URL variable. ISE will dynamically insert the PSN FQDN and portal port number during authorization. Ruckus also supports pushing an ACL name via RADIUS from the standard RADIUS Filter-ID attribute. SmartZone also now supports CoA for URL redirection once the client successfully logs into the ISE portal. Ruckus-EXTERNAL-URL VSA Filter-ID ACL Once the NAD profile is modified and applied to the NAD definition for a Ruckus Controller, the ISE guest rules can be built out just like you normally would for any Cisco NAD.  On the Ruckus SZ side, the ACL must be configured to allow DHCP, DNS, and access to the ISE nodes. An open/OWE SSID with MAC filtering ...
Post a Comment
Read more

Mountain Biking Flatwoods Wilderness Park

Image
My wife and I completed a 6.5 mile ride at Flatwoods Wilderness Park, located in Northeastern Hillsborough County. I've biked this park since middle school, but it's been many years since I was last here. The park has over 30 miles of off-road bicycle single track. The land is owned by the Southwest Florida Water Management District (SWFWMD) and operated as a Conservation Park by Hillsborough County . The bike trails are maintained by the SWAMP Mountain Bike club , which operates and manages several off-road mountain bike trails throughout the Tampa Bay Area.  The Flatwoods area is a massive flood plain and headwaters of the Hillsborough River. Formally known as the Hillsborough Flood Detention Area (HFDA) In the rainy season, or during hurricanes, SWFWMD controls flow into the Hillsborough River using a flood control structure originally built in the 1960s to protect the cities of Tampa and Temple Terrace from floodwaters. An alternative water flow path, the Tampa Bypass Cana...
Post a Comment
Read more

Popular posts from this blog

Fix Cisco ISE Messaging Service

Cisco Identity Services Engine 2.6 introduced the concept of the ISE Messaging Service as an encrypted, lightweight protocol to replace syslog communication between the ISE nodes for logging purposes.  The ISE Messaging Services runs over TCP/8671.  In 2.6 Patch 2 and later, the Cisco ISE Messaging Service is enabled by default.   The overall implementation of the ISE Messaging Service has been buggy (but has gotten much better in recent versions) in both new ISE builds and upgrades.  One solution is simply to disable the ISE Messaging Service within Administration > System > Logging.  But then the ISE logging traffic isn't encrypted and the legacy syslog delivery method is not as efficient as the ISE Messaging Service so we will focus the rest of this article on how to identity and fix the ISE Messaging Service. Problem Identification Usually problems with the ISE Messaging Service involve a blank Live Logs page.  You know authentication is...
Read more

ClearPass MPSK per Device Type with Profiling

Image
Multiple Pre-Shared Key or MPSK helps solve for IOT or other endpoint device types that are not 802.1X capable.  The Aruba ClearPass default implementation of MPSK (the configuration created by the wizard) requires manually registering, enrolling, and managing individual PSK keys per endpoint using the ClearPass Guest dashboard.  While the most secure approach, excluding any sort of API based automation, this can obviously be a nightmare to manage and support due to the sheer number of PSKs.  This approach instead delivers a unique PSK per device type (printer, thermostat, etc.) so that each flavor of endpoint would have its own PSK.  If one PSK was compromised, then only those endpoints would need to be manually re-configured.  PSK rotation would also be limited to only those specific device types allowing rotation to take place slowly over several weeks rather than all devices at the same time on the SSID with a traditional single PSK; lessoning the burde...
Read more

Cisco Designated VIP 2024

I'm pleased  to announce that I have been recognized as a Cisco Community Designated VIP for 2024 for my assistance in the Cisco Secure Network Access Control community focusing on Identity Services Engine.  Be sure to check out all of the   Cisco Community Designated VIPs .
Read more