topic Re: tcp/udp ports allowed across firewall between ISE nodes in Network Access Control

tcp/udp ports allowed across firewall between ISE nodes

cciesec2011 — Mon, 02 Sep 2019 17:45:33 GMT

I have 2 ISE nodes version 2.6 patch 2. ISE1 is the primary admin/MnT and PSN node that is behind a firewall interface. ISE2 is the secondary admin/MnT node that is behind another firewall interface. What TCP/UDP ports must be allowed across the firewall for the ISE nodes to be communicated with each other effectively.

TIA.

Re: tcp/udp ports allowed across firewall between ISE nodes

Rob Ingram — Mon, 02 Sep 2019 17:53:13 GMT

Hi,

Here is the port reference for ISE.

HTH

Re: tcp/udp ports allowed across firewall between ISE nodes

cciesec2011 — Mon, 02 Sep 2019 18:15:15 GMT

do you have first hand experience on specific ports and protocols?

Re: tcp/udp ports allowed across firewall between ISE nodes

Colby LeMaire — Mon, 02 Sep 2019 18:59:06 GMT

What is your specific question or concern? The reference lays out all of the communication requirements for the various node types and features.

Re: tcp/udp ports allowed across firewall between ISE nodes

cciesec2011 — Tue, 03 Sep 2019 09:36:18 GMT

@Colby LeMaire wrote:
What is your specific question or concern? The reference lays out all of the communication requirements for the various node types and features.

Because the documentation is either wrong or incomplete for version 2.6 patch 2. I opened a TAC case with Cisco and even the TAC engineer is not very clear on the ports and protocols that have to be opened on the firewalls for it to work properly. The TAC engineer told me one thing and I am seeing something else.

Re: tcp/udp ports allowed across firewall between ISE nodes

Colby LeMaire — Tue, 03 Sep 2019 17:07:35 GMT

If you have packet captures showing that the documentation is incomplete or wrong, then provide that to TAC and have them open a documentation bug. Or post your information here to the community so the folks in the BU can review and verify.

Re: tcp/udp ports allowed across firewall between ISE nodes

Jason Kunst — Tue, 03 Sep 2019 17:58:18 GMT

Please do provide us what's wrong so we may update. if there is TAC case provide that so we can follow up. I would ask they open defect