I’m wondering if anyone has tried to configure SSL Decryption with the criteria of a custom URL [object] category in Cisco SourceFire. The reason I want to do this is due to a testing scenario—put a couple of URL’s in a URL group (Ex. yahoo.com, eicar.org & others), tell the SSL decryption policy that user “jdoe” needs decryption when going to these URL’s, have that user download test malware from eicar.org to demo the functionality etc. Without the ability to do this, there is a whole demo I cannot do. From what I can see—I created the custom URL object & URL group (objects > object management, URL etc.) That custom URL object is there if I go to Policies > Access Control Policies & look at my URL based ACP. In other words, I can click on that custom URL object & do some action with it. When I go to Policies > SSL & create an SSL decryption policy, click on the “category” tab, the regular well-known URL pre-defined URL categories are there. But the custom URL object / category is not even there, not even selectable (With or without having done a “deploy” after I created the URL object). I’m now thinking that you cannot configure a custom URL object to be included as a URL category where you’re doing SSL decryption as the custom URL object does not show up as a selectable item in the config. Because of that, I’m also thinking that, if you need to do SSL decryption off of URL categories in Cisco SourceFire, you need the URL filtering license Thoughts? Thanks!

That's certainly unusual. How was cert installed? Was it manually or via GPO? Who issued the cert and if it was Windows CA, which template was used?

Hello,

We would like to authenticate Cisco IP Phones with ISE with the use of certificates. From the IP Telephony for 802.1X Design Guide states that you can use X.509 certificates for phone authentication and that they can be validated by the ACS in a single authorization rule without the need to configure and maintain a database of phone usernames and/or passwords, so I guess this is true of ISE.

It also states that in an 802.1X authentication, the AAA server is responsible for validating the certificate provided by the phone. To do this, the AAA server must have a copy of the root CA certificate that signed the certificate of the phone. The root certificates for both LSCs and MICs can be exported from the Unified CM Operating System Administration interface and imported into your AAA server.

Now the question is that we want to use a self-signed CAPF of the CUCM to sign the LSCs, so we need to export that and import it in ISE, but under system certificates in ISE in Used by we can only have one certificate selected.

So if my understanding is correct, we can not have a CA to issue PC certificates and a self-signed CAPF for the phones and both be active on ISE, right?

Thank you,

Aris.

We do not specifically have a video on mentioned scenario.  However, you should be able to achieve it doing the following.
1. Create SSID per tenant
2. Point SSID to either same or different ISE RADIUS server
3. In case of same ISE server, you can identity connection based on SSID and make it authenticate against various AD join point
4. Once traffic tunneled to WLC, you can drop them into an intermediate switch and sort them into different tenant network.

Please keep in mind that WLC does not support multi-tenant management

Firepower can operate without FMC so FMC can fail and FP will continue to operate. You always upgrade FMC first then follow by the sensors. FYI.. FMC take around 1-2hr to upgrade.