ISE 2.2 Release

[thomas]

Download

Download the Cisco Identity Services Engine (ISE) 2.2 which was released on January 31, 2017.

Features

From the ISE 2.2 Release Notes:

• Ability to Detect Anomalous Behavior of Endpoints
• ACS to ISE migration Tool Enhancements
• Auth VLAN DHCP and DNS Service Enhancements
• Context Visibility Enhancements
• Cryptobinding TLV Support
• Custom User Attributes
• Dial-in Attribute Support
• Dictionary Check for Internal User and Admin User Password
• Easy Wireless Setup
• Endpoint Identity Groups in Posture Policy
• Guest Enhancements
• JSON Support for APIs
• Network Conditions
• Network Device Group Hierarchies
• OTP Token Caching
• Passive Identity Connector
• Policy Set Enhancements
• Posture Enhancements
• pxGrid Enhancements
• RADIUS DTLS
• RADIUS IPSec Security for Cisco ISE-NAD Communication
• RADIUS Shared Secret Minimum Length
• Serviceability Enhancements
• Session Trace Test Cases
• Smart Call Home Enhancements
• Stateless Session Resume Support for EAP-TLS
• Support for Enrollment Over Secure Transport
• Support for Microsoft Hyper-V Virtual Machines
• Support for Multiple TrustSec Matrices
• Support for DefCon Matrices
• Support for MySQL
• TC-NAC Enhancements
• TrustSec-ACI Integration Enhancements

Documents

• Cisco Identity Services Engine 2.2 Documentation Overview - Cisco
• Release Notes for Cisco Identity Services Engine, Release 2.2 - Cisco
• Cisco Identity Services Engine Administrator Guide, Release 2.2  - Cisco
• Cisco Identity Services Engine Installation Guide, Release 2.2  - Cisco
• Cisco SNS-3400 Series Appliance Hardware Installation Guide  - Cisco
• Cisco SNS 3500 Series Appliance Hardware Installation Guide  - Cisco
• Cisco Identity Services Engine Upgrade Guide, Release 2.2  - Cisco
• Sponsor Portal User Guide for Cisco Identity Services Engine, Release 2.2  - Cisco
• My Devices Portal FAQs, Release 2.2  - Cisco
• User Guide for Cisco Secure ACS to Cisco ISE Migration Tool, Release 2.2  - Cisco
• Cisco Identity Services Engine API Reference Guide, Release 2.x - Cisco
• Cisco Identity Services Engine CLI Reference Guide, Release 2.2  - Cisco
• Cisco Identity Services Engine Network Component Compatibility, Release 2.2 - Cisco
• Certificate Provisioning Portal FAQs, Release 2.x  - Cisco
• Active Directory Integration with Cisco ISE 2.x  - Cisco
• Setting up PassiveID in ISE 2.2
• Configure TrustSec Multiple Matrices on ISE 2.2 - Cisco
• Configure Maximum Concurrent User Sessions on ISE 2.2 - Cisco
• Configure ISE 2.2 PIC with Active Directory WMI Provider - Cisco
• Configure ISE 2.2 RADIUS DTLS - Cisco
• Configure ISE 2.2 IPSEC to Secure NAD (IOS) Communication - Cisco
• Configure ISE 2.2 Threat-Centric NAC (TC-NAC) with Rapid7 - Cisco
• Configure Anomalous Endpoint Detection and Enforcement on ISE 2.2 - Cisco
• ISE 2.2 Client Provisioning and Application Visibility Configuration Example - Cisco
• Configure ISE 2.2 for integration with MySQL server - Cisco
• Configure Easy Wireless Setup ISE 2.2 - Cisco
• Configure ISE 2.2 IPSEC to Secure NAD (ASA) Communication - Cisco

Videos

• Visibility is the new perimeter; It’s time for Cisco ISE 2.2
• ISE 2.2 Announcement Video - YouTube
• ISE 2.0 to 2.2 GUI Upgrade - YouTube
• ISE Setup for Wireless Intro - YouTube
  • ISE Setup For Wireless - Self-Reg Guest in 5 minutes - YouTube
  • ISE Setup For Wireless - Hotspot Guest in under 5 minutes - YouTube
  • ISE Setup For Wireless - Sponsored Guest in 5 minutes - YouTube
  • ISE Setup For Wireless - BYOD Single SSID in 5 minutes - YouTube
  • ISE Setup For Wireless - BYOD Dual SSID in 5 minutes - YouTube
  • ISE Setup For Wireless - Secure Access DO1X in 5 minutes - YouTube
• ISE 2.2 Android Provisioning with EST Authentication (Certificate Generation Failed) - YouTube
• Cisco ISE Anomalous Behavior Detection - YouTube
• Using ISE 2.2 Internal Certificate Authority (CA) to Deploy Certificates to Cisco Platform Exchange Grid (pxGrid) Clients
• ISE 2.2 Adds Cisco Cognitive Threat Analytics (CTA) to Its Growing Intelligence Ecosystem - YouTube
• Network Node Videos with ISE 2.2:
  • 1.1 - ISE Lab Overview
  • 1.2 - Configuring Server 2012 - AD, DNS, DHCP, CA, Certificate Templates, GPO
  • 1.3 - Initial Configuration of ISE
  • 1.4 - Initial Configuration of FTD, CSR, and ASAv
  • 1.5 - Switch Configuration
  • 1.6 - Profiling Fun!
  • 1.7 - The Active Directory Probe
  • 1.8 - Wired 802.1x Configuration
  • 1.9 - WLC Installation and Setup
  • 1.10 - Wireless SSID Creation with ISE 2.2

• 1.12 - Hotspot and Self Registering Guest Setup
• 1.13 - BYOD Configuration
• 1.14 - AMP For Endpoints Overview and Integration with ISE
• 1.15 - TACACS+ for WLC
• 1.16 - TACACS+ for ASA
• 1.17 - TACACS+ for IOS
• 1.18 - ISE 2.2 Application Visibility and Posture
• 1.19 - Prime Infrastructure and ISE
• 1.20 - Firepower & ISE integration and Rapid Threat Containment
• 1.21 - ISE & WSA Integration

[Ashley Sahonta]

Hi,

I have ISE 2.2.0.470 deployed in my lab and was hoping I could test ou the Easy Wireless Setup wizard, however it is not showing.

Is there a way to get access to that wizard?

[thomas]

Hi Ashley, there are 3 ways you should be able to launch the Easy Wireless Setup:

1) On first login, you should be prompted to try it with a modal dialog

2) Every time you login, in the upper right-hand corner under the (>) icon,  you should see

Click here to do wireless setup Do not show this again.×

3) in the upper right-hand corner, click the (>) icon and select Wireless Setup (Beta)

For videos showing how to launch and use the Easy Wireless setup, see our ISE 2.2 Setup Tool for Wireless - YouTube playlist.

[Ashley Sahonta]

Hi Thomas,

Thanks for the reply. I get straight to the homepage and the top right button only gives the option for PassiveID and Visibility wizard.

I performed an upgrade from 2.1, not sure if that makes a difference?

[thomas]

Sounds like it could be a bug.

I'll have to research it and email you directly.

Thank you for bringing this to our attention.

[thomas]

I confirmed with our team that the ISE Easy Wireless Setup does not work after an Upgrade.  It is only supported for new installations.

The reason for this is that this first release of the Easy Wireless tool is not robust enough to work with an existing wireless deployment and all of the complications that may introduce for ISE to configure it. We even label the feature as Beta in the drop-down menu on clean installations. We assume that if you upgraded/restored ISE, there there is a high probability that you were already doing Wireless so we hide the menu.

I'm sorry that was not clearly communicated to you beforehand. The ISE 2.2 Administrators Guide under Introduction >  What Is Wireless Setup in the 2nd bullet says Wireless Setup is only supported for new installations.

[Ashley Sahonta]

Great, thank you for the response.

[thomas]

Update:

We learned that you can re-enable Easy Wireless Setup even after an Upgrade or Restore using the CLI!

1. Use the command application configure ise
2. Choose Option 17 (Enable/Disable wifi setup)

You should then be able to see the menu options in the GUI.

The ISE 2.2 documentation will be updated to reflect this capability.

[thomas]

Bug id: CSCvd19127 - Wireless Setup can be enabled from CLI after upgrade, can't accessible from UI.

[GERALD LECAILLIER]

Hi,

Thanks for all this labs. Do you have one about deploying EAP-TLS (wired/wireless) using ISE 2.2 as Certificate Authority, and best way to deploy certificat on the clients ?