Connecting Cisco ISE in Axonius

o connect the adapter in Axonius, provide the following parameters.

Required Parameters

1. Cisco ISE Domain - Enter the hostname or IP address of the Cisco ISE server that Axonius can communicate with via the required ports. To use a different port (rather than 9060) to connect to Cisco ISE ERS API, you need to provide a domain with the port, for example to use port 3000, this field should be ciscoise.node.local:3000

2. User Name and Password - Enter the credentials for a user account that has the required permissions to fetch assets.

Optional Parameters

1. Cisco pxGrid Domain - Set this parameter to connect to a pxgrid domain instead of the regular domain used for ERS. When this parameter is not set, the same ISE domain is used for both pxgrid and ERS APIs.

2. Use pxGrid to Fetch Live Sessions -

   • If enabled, Axonius will enrich the data collected from Cisco ISE by enabling pxGrid. Using pxGrid requires a plus licence and requires an additional authentication step from pxGrid Services on your Cisco ISE domain. For more details, see Cisco ISE Initial Setup.
   • If disabled, Axonius will not enable pxGrid.

3. pxGrid Client Certificate / pxGrid Client Private Key / pxGrid Client Private Key Password / pxGrid Client Root CA chain - Those settings are required for xmpp client with pxgrid 1.0. For details, contact Axonius Support.

   📘

   Note

   The xmpp client has been deprecated by Cisco. Axonius will continue supporting it, but it is advised to transition to the REST client to fetch pxGrid data.

4. Use v1.1 Object Model for ERS API - Select when using either Cisco ISE versions 2.4 or 2.7, or if you receive a “Connection Fails” HTTP 400 error.

   📘

   Note

   This parameter is only used with the ERS API. It has no effect when using the pxGrid API.

5. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

6. HTTPS Proxy - Enter an HTTPS proxy address to connect the adapter to a proxy instead of directly connecting it to the domain.

7. API Gateway Connection - Enable this to use API gateway parameters for authentication. After enabling this option, select the API Gateway Type:

   • Layer7 - Fill in the parameters that are displayed. Read about Layer7 API Gateway Parameters.
   • IBM API Connect - Fill in the following parameters, all required unless noted otherwise:
     • OAuth2 Token URL - The full token endpoint URL for your identity provider. Example: https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token
     • Client ID - The OAuth client ID for IBM API Connect authentication.
     • Client Secret- The OAuth client secret for IBM API Connect authentication.
     • Scope - The OAuth scope requested when obtaining the access token. Example: api://{resource}/.default
     • Service Path (optional) - Optional service path prefix appended to Host Name or IP Address to route requests to the target service through the gateway. Example: cisco-ise

To learn about additional optional/common adapter connection parameters, see Adding a New Adapter Connection.