{"id":1239,"date":"2020-11-18T22:36:18","date_gmt":"2020-11-18T22:36:18","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=1239"},"modified":"2020-11-18T22:36:56","modified_gmt":"2020-11-18T22:36:56","slug":"ise-2-x-learning-and-explore-more-features","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=1239","title":{"rendered":"ISE 2.X Learning and explore more features"},"content":{"rendered":"\n

As i was workiend 1.X Long Long and discontinued due that i have to working AWS cloud Service for 2-3 years for a Client.<\/p>\n\n\n\n

Once I got back I had worked little time 2.2 for the short term, then moved to the organization, still Holding ACS 4.X and 5.8 ( tried many times promote ISE as demo models to protect some devices which have no control, I failed to win that confidence from the organization I work for).<\/p>\n\n\n\n

I have been supporting and doing many many scenario Labs, not got a chance to write one good document, its time for ISE, since we hear marketing term from cisco now called “SD-Access” – which has major requirement of ISE , since ISE center focus interms of Scalable Groups and Identity – so refreshing my knowledege by writing this document and couple of new features to test in next blog while i am doing some Labs.<\/p>\n\n\n\n

Below diagram give you one stop which tell what is ISE ( still not sure what ISE, go back to basic ISE information – may be wrong blog for newbies)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

What ISE can do ?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

High level Solution Overview<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Selecting the RIGHT Model of the ISE device for your deployment.<\/p>\n\n\n\n

Note : Make sure you spend some time on this and decide what model your required for your environment.<\/p>\n\n\n\n

*Personally stay away from VM, – this will not give you as expected results, until you are dedicate resouces and Lock CPU – but it will be shared in esxi – never seen ISE or FMC Performs as expected like appliance Cisco build – DO NOT WASTE TIME think of VM.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Hardware Performance PSN<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

How ISE can Adapt to Enviroment – From Scratch.<\/p>\n\n\n\n

ISE required good planning – not like build the node it done miracles as expected.<\/p>\n\n\n\n

I follow most experience steps – Once ISE Build and integrated with your environment. Start with<\/p>\n\n\n\n

  1. Device Admin – which replaces your ACS with ISE for Role based access for the Devices in the network.<\/li>
  2. Guest and Secure Wireless Access – this will secure your Guest users and your Corporate Wireless access.<\/li>
  3. Asset Visibility – this will give you clear picture of environment what devices in the network and it will give you ability to make and plan – right VN ( DNAC ) – both macro and micro segmentation planning.<\/li>
  4. Secured Wired Access – This will closed down your wired access with Dot1.X deployment – suggest to start with Low effected area to Critical area – not to do mass deployment.
    1. 4.1 – here you can introduce – Threat containment – for more securty visibility.<\/li><\/ol><\/li>
    2. BYOD – You can start planning – any non-authorised devices can get in to network and what kind of access can get back on the profiles.<\/li>
    3. Segementation – this where your VN, Scalable Group come to play.<\/li><\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      7. Security Echosystem integration – this more of pXGrid deployment with other partner systems.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      8.Complains & posture – for the Posture checks.<\/p>\n\n\n\n

      Since i have described how we can go gradually deployment – lets discuss also License requirement.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      DNA Space with ISE<\/strong><\/p>\n\n\n\n

      In the Desing level you can do all planning, what you can do as part of DNA center Design Level.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      Elements required to make this happend, ISE Play Major role in SD-Access or DNAC space. this is part of the solution. you get 360 Degree visibility and take action in ~5sec (cisco claim ) to remidiate or block the attack going to happening in the network.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      This is part of base design very clear matrix required what to access and what not.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      ISE Provide more visibility in the network.<\/p>\n\n\n\n

      I am running 2.4 as part of CCIE Sec requirement.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      By Summary it shows –<\/p>\n\n\n\n

      Metric<\/p>\n\n\n\n

      • Total endpoints<\/li>
      • Active Endpoints<\/li>
      • BYOD Endpoints<\/li>
      • Compliance<\/li><\/ul>\n\n\n\n
        \"\"<\/figure>\n\n\n\n

        Authentications – by different device types and models<\/p>\n\n\n\n

        Network Devices – Switches, routers, WLC<\/p>\n\n\n\n

        Endpoints – end points<\/p>\n\n\n\n

        BYOD Endpoints – Guest non-trusted users<\/p>\n\n\n\n

        Alarms – this alarms and alerts. – user friendly readable.<\/p>\n\n\n\n

        System Summary – Overall system , status and cluster of ISE.<\/p>\n\n\n\n

        ISE – Visiblity Setup wizard<\/p>\n\n\n\n

        • it automatically finds and discovers it over all the network – and finds all devices with more information.<\/li><\/ul>\n\n\n\n
          \"\"<\/figure>\n\n\n\n

          ISE Profiling work with ISE and DNAC<\/p>\n\n\n\n

          <\/p>\n\n\n\n

          \"\"<\/figure>\n\n\n\n

          ISE does the Probing – 2 types Active and Passive<\/p>\n\n\n\n

          \"\"<\/figure>\n\n\n\n

          how the process works on high level.<\/p>\n\n\n\n

          \"\"<\/figure>\n\n\n\n

          how the information collected based in Device Sensors<\/p>\n\n\n\n

          \"\"<\/figure>\n\n\n\n

          ISE come with defaul many profiles example :<\/p>\n\n\n\n

          <\/p>\n\n\n\n

          \"\"<\/figure>\n\n\n\n

          <\/p>\n\n\n\n

          More to add as it goes<\/p>\n\n\n\n

          <\/p>\n\n\n\n

          Happy Labbbing !!!!<\/p>\n","protected":false},"excerpt":{"rendered":"

          As i was workiend 1.X Long Long and discontinued due that i have to working AWS cloud Service for 2-3 years for a Client. Once I got back I had worked little time 2.2 for the short term, then moved to the organization, still Holding ACS 4.X and 5.8 ( tried many times promote ISE […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,10,2],"tags":[],"class_list":["post-1239","post","type-post","status-publish","format-standard","hentry","category-ccie-sec","category-ccie-rns","category-cisco"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1239"}],"version-history":[{"count":12,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1239\/revisions"}],"predecessor-version":[{"id":1271,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/1239\/revisions\/1271"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}