topic Re: Automate ISE endpoint export in Network Access Control

Automate ISE endpoint export

mike.ng.kl — Fri, 23 Nov 2018 22:26:01 GMT

Hi ISE experts

Is there a way to schedule endpoint export to a csv file regularly on ISE? I can see the export button but would like to automate it. Cannot find anything about the related automation in ISE documentation.

Thank you in advance.

Cheers

Mike Ng

Re: Automate ISE endpoint export

Nadav — Sat, 24 Nov 2018 13:09:59 GMT

One option is an ERS script. Check out:

https://hostname:9060/ers/sdk#Get-All

Just make sure ERS is enabled on your PAN and the user is in the ERS Admins group.

Re: Automate ISE endpoint export

mike.ng.kl — Sun, 25 Nov 2018 16:46:08 GMT

Thank you for your reply but ERS API does not scale. It took 18 hours to dump 200K mac addresses with endpoint group information. The export button on GUI only took 15 mins. Is there a way to replicate the GUI export action?

Re: Automate ISE endpoint export

pan — Sun, 25 Nov 2018 17:11:37 GMT

You can export the endpoint from CLI as well. What you can do is write some script which can login to ISE and run command "application configure ise".

ise-01/admin# application configure ise

Selection configuration option
[1]Reset M&T Session Database
[2]Rebuild M&T Unusable Indexes
[3]Purge M&T Operational Data
[4]Reset M&T Database
[5]Refresh Database Statistics
[6]Display Profiler Statistics
[7]Export Internal CA Store
[8]Import Internal CA Store
[9]Create Missing Config Indexes
[10]Create Missing M&T Indexes
[11]Enable/Disable ACS Migration
[12]Generate Daily KPM Stats
[13]Generate KPM Stats for last 8 Weeks
[14]Enable/Disable Counter Attribute Collection
[15]View Admin Users
[16]Get all Endpoints
[17]Enable/Disable Wifi Setup
[18]Reset Config Wifi Setup
[19]Establish Trust with controller
[0]Exit

Option 16 is what you have to select. File will be present in /localdisk and then you can export them using copy command.

Re: Automate ISE endpoint export

Nadav — Sun, 25 Nov 2018 18:32:29 GMT

If ERS is really that much slower than using a local application call,
maybe it's worth opening a TAC case whether you go the REST route or not.

Re: Automate ISE endpoint export

mike.ng.kl — Sun, 25 Nov 2018 23:33:14 GMT

Thank you will test it out.

Re: Automate ISE endpoint export

mike.ng.kl — Sun, 25 Nov 2018 23:38:18 GMT

It is apparently a design issue of ERS API. The get-all ERS call only dump the endpoint ID and MAC but not any details. To dump endpoint group and profile of each endpoint, it needs one get endpoint call per endpoint. So for 200K endpoints, the script needs to call the ERS API for 200K times - a definitely high number. If ERS can support get endpoint bulk call, it should resolve the issue - but unfortunately not.

Re: Automate ISE endpoint export

Jason Kunst — Thu, 20 Dec 2018 03:25:51 GMT

thanks i would recommend opening a tac case and getting a defect filed. I will also bring up with our PM for API. Please let us know the defect id

Re: Automate ISE endpoint export

paul — Thu, 20 Dec 2018 15:38:42 GMT

I believe the other issue is the endpoints are only shown in increments of a 100. So you have to constantly make further calls to parse through the Get-All process. On my large install with 600k+ endpoints that is a non-starter.

Re: Automate ISE endpoint export

Parag Mahajan — Fri, 21 Dec 2018 05:09:57 GMT

I have faced similar challenge for one of my customer. We have filed below defect.

CSCve05681 ERS Get-All takes very long time for response

CSCvg64354 ENH ISE ERS calls should be processed much faster

Re: Automate ISE endpoint export

Michael Burk — Thu, 08 Oct 2020 16:28:39 GMT

Man this is a really great thread and saved alot of research. Would anyone be willing to share what their SSH script looked like? Thanks!

Re: Automate ISE endpoint export

elahtrebor — Fri, 04 Feb 2022 21:59:11 GMT

I know this is a late answer but here is short script enumerating the ERS api using PERL and CURL to export all devices. (Attached)

Note must have CURL and set your ERS user, PW, and ISE host in the script. Dumps the JSON but can easily be parsed.

The script just calls a loop against the ERS api and looks for "nextPage" in the output.