topic Re: ISE Integration with Umbrella in Network Access Control

ISE Integration with Umbrella

robinwhi — Thu, 19 Oct 2017 09:13:13 GMT

Hello

I am interested to know if ISE can be used to control policy within Umbrella. Umbrella can hold profiles for different user groups for, say, corporate and guest users. If a guest user connects via a WLC can ISE provide the profile details to Umbrella so that their DNS access is limited to a subsection of URL destinations?

Thanks

Rob

Re: ISE Integration with Umbrella

Jason Kunst — Thu, 19 Oct 2017 10:51:37 GMT

No current integration that I know of but will double check

please reach out to umbrella team for this enhancement

Re: ISE Integration with Umbrella

robinwhi — Thu, 19 Oct 2017 10:56:05 GMT

Looks like Umbrella relies on the WLC providing the group information to it, so that it confirms which profile a user is in, but I guess ISE can not populate this on the WLC?

Re: ISE Integration with Umbrella

Jason Kunst — Thu, 19 Oct 2017 11:08:25 GMT

I am not aware of this integration or what group you’re referring to

The best way for this to work is for umbrella to be able to consume pxgrid information for a scalable group tag to use in its policy

Please reach out to Umbrella team to work with ISE team

I am currently checking with our product managers

Re: ISE Integration with Umbrella

Jason Kunst — Thu, 19 Oct 2017 20:07:24 GMT

I also reached out to our PM enoy to see if something like this exists.

Re: ISE Integration with Umbrella

Craig Hyps — Fri, 20 Oct 2017 15:56:16 GMT

We are working with Umbrella team but nothing which can be discussed at this time in public forum. We do work indirectly today via RADIUS and pxGrid. For example, users can be authorized to WLC and WLC integrate role assignments to Umbrella. Similarly, ISR can receive Passive/Active identity via pxGrid and communicate that for Umbrella integration.

Craig

Re: ISE Integration with Umbrella

r_wideman — Mon, 27 Aug 2018 19:02:25 GMT

Craig, Do you have any updates for this? I do have ISE and WLC (8.5) and would like to see deeper integration.

Re: ISE Integration with Umbrella

hslai — Thu, 30 Aug 2018 02:53:47 GMT

I would suggest to check out materials such as Cisco Umbrella WLAN Integration Guide - Cisco

Re: ISE Integration with Umbrella

riwakefi — Wed, 07 Aug 2019 02:50:16 GMT

The Radius and WLC route seems to only work if you're pointing users to the cloud DNS IP addresses 208.67.220.220 & 208.67.222.222, or forcing them to the cloud IPs using FORCED mode. Most of my customers are going the local Umbrella VA route and there doesn't appear to be a way to "tell" the WLC that the local VAs the users are hitting are actually Umbrella servers. We're still testing this, but not looking good so far...

https://docs.umbrella.com/deployment-umbrella/docs/6-local-dns-forwarding