Meraki Community

arom · ‎Feb 17 2024

Interesting finding, thank you for the information! Strange that the setting is not enabled by default. I have reached out to the support now 🙂

arom · ‎Feb 17 2024

Hi team, We are currently testing out Cisco ISE with Meraki MS120-switches. When testing out the "Critical VLAN" feature, we noticed that the endpoint/switchport somehow got stuck on the mode. The test was created as per the following: 1. Disconnected the endpoint from the switchport. 2. Changed the PSK to a faulty PSK on the access policy on the switch (to simulate that the switch cannot communicate towards the ISE server). 3. Connected the endpoint, and the endpoint was successfully put on the Critical VLAN which is good. 4. We changed back the PSK to the correct one in the access policy, and here the switch/switchport never tried to reauthenticate again. We disconnected/connected the device several times to the switchport but every time the endpoint got registered to the Critical VLAN. In ISE, we couldn't see that the endpoint tried to authenticate. To resolve the issue, we reconfigured the switchport from cisco ise policy to "open", and then back to cisco ise policy, and after that the endpoint did a successful authentication again. Is this by design, or a bug?

arom · ‎Nov 27 2023

I want to thank you for your responses and help with the questions I had. I will create a case to Meraki and Cisco to see if there is a way to use ISE pxGrid to fetch information from Meraki's API and use that information to make decisions about authorizations. If anyone is interested in this use case, I can return later to this post and summarize my findings 🙂 Best regards, arom

arom · ‎Nov 26 2023

Thanks. Im very familiar with these modules and worked with them before. The modules are great but only works on devices that have support for an agent. The profiling scenarios i'm interested in has to agent-less as most devices that are of interest can't run an agent unfortunately.

arom · ‎Nov 26 2023

I have read this article (have a link to it in the post). The last section explains the limited profiling capabilities with Meraki and ISE, but I want to believe there is more support to it with pxGrid or similar, as other vendors have solved it!

arom · ‎Nov 26 2023

Yeah maybe! Just wanted to see if anyone in the community had some experience around this.

arom · ‎Nov 26 2023

Hello team! I'm researching on what type of profiling capabilities there is when using Meraki (in this case MS120) and NAC/ZT solution. I've looked into Cisco ISE, Forescout, Aruba Clearpass and FortiNAC. Looking at the official Cisco ISE support for profiling, there is basically only support for LLDP/CDP and RADIUS calling-stations-id attribute (https://community.cisco.com/t5/security-knowledge-base/how-to-integrate-meraki-networks-with-ise/ta-p/3618650). Other vendors, like Aruba and Forescout, tells me they can fetch information from Merakis API to get profiling information on devices and use that information to perform decisions on authorizations. So my questions is: 1. Anyone knows why there is no official support for Cisco ISE integrating with Meraki's API over pxGrid? 2. Has anyone tried integrating Meraki's API to NAC-solutions, like above mentioned, for profiling purposes, and what was the result? Did it work as expected and what kind of capabilities can you expect? Thanks and best regards, arom

Meraki Community

About arom

arom

Community Record

Badges

Re: Endpoint stuck on "Critical VLAN"

Endpoint stuck on "Critical VLAN"

Re: Profiling

Re: Profiling

Re: Profiling

Re: Profiling

Profiling

Profiling