Cisco Identity Services Engine (ISE)

The Cisco Identity Services Engine (ISE) adapter connects to the Cisco ISE management interface in order to enable the creation and enforcement of security and access policies for endpoint devices connected to managed routers and switches.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices

Parameters

1. Cisco ISE Domain (required) - The hostname or IP address of the Cisco ISE server that Axonius can communicate with via the Required Ports.
2. Cisco pxGrid Domain (optional) - Set this parameter to connect to a pxgrid domain instead of the regular domain used for ERS. When this parameter is not set, the same ISE domain is used for both pxgrid and ERS APIs.
3. User Name and Password (required) - The credentials for a user account that has the Required Permissions to fetch assets.
4. Use pxGrid to Fetch Live Sessions -
   • If enabled, Axonius will enrich the data collected from Cisco ISE by enabling pxGrid. Using pxGrid requires a plus licence and requires an additional authentication step from pxGrid Services on your Cisco ISE domain. For more details, see Authorize Axonius in pxGrid Services.
   • If disabled, Axonius will not enable pxGrid.
5. pxGrid Client Certificate / pxGrid Client Private Key / pxGrid Client Private Key Password / pxGrid Client Root CA chain (optional) - Those settings are required for xmpp client with pxgrid 1.0. For details, contact Axonius Support.

6. Use v1.1 Object Model for ERS API - Select when using either Cisco ISE versions 2.4 or 2.7, or if you receive a “Connection Fails” HTTP 400 error.

7. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

8. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Fetch endpoints -
   • If enabled, all connections for this adapter will fetch data from the ISE endpoint.
   • If disabled, all connections for this adapter will not fetch data from the ISE endpoint.
2. Fail client on pxGrid connection error (required, default: True)- Select to propagate errors originating from the PxGrid connection when Use pxGrid to fetch live sessions is enabled for a client. When this is not set, errors are propagated only when there are errors from both pxGrid and ERS connectivity to a client.

3. Skip devices without IP address (required, default false)- Select this option to not fetch devices that do not have an IP address.
4. Only include devices that have a name OR an IP address (required, default false) - Select this option to only fetch devices that have either an asset name or an IP address.
5. Only include devices that have a name AND an IP address (required, default false) - Select this option to only fetch devices that have both an asset name and an IP address.

Required Ports

Axonius must be able to communicate with the value supplied in Cisco ISE Domain via the following ports:

• External RESTful Services (ERS) REST API: Older versions of ISE may use TCP/9060, Newer version of ISE use 443, set this in adapter configuration using ise.domain.com:443.
  Set the port to that used in your version of ISE.

• pxGrid Subscribers may need to utilize port 8910.

• For more details, see Cisco ISE Ports Reference.

• Cisco Developer Documentation

Required Permissions

The value supplied in User Name must have read access to devices.
To create a service account for Axonius with the sufficient permissions for calling the Cisco ISE API, do as follows:

1. Navigate to Administration > Admin Access > Administrators > Admin Users and click Add.

   

2. Assign an access type. Select ReadOnly. You can choose between Read/Write or ReadOnly.

3. Add the user to one of the following Admin Groups: ERS Admin or ERS Operator.

4. Enable ERS (External RESTful Services) to allow REST calls. To do this, navigate to Administration > System > Settings > ERS Settings then select Enable ERS for Read/Write under the Primary Administration Node:

   

   Note:

   The ERS setting must be enabled after each upgrade as it is reset to "disabled" during each upgrade. If you plan on utilizing this adapter, we recommend adding a note to your Cisco ISE upgrade process documentation that the REST API should be enabled at the end of each upgrade.