topic Re: ISE Device Administration Service in Network Access Control

ISE Device Administration Service

jordi.cano — Fri, 11 Aug 2017 08:28:14 GMT

Hello team,

On CISCo ISE:

Is it a best practice to use the interface Giga eth0 (dedicated to management) as a port for Device Administration Service to manage administrative access for Cisco IOS based network devices (AAA, TACACS or RADIUS)?

I have Cisco ISE HA in Small Deployment Network (with two node of ISE)

Best regards

Jordi

Re: ISE Device Administration Service

keglass — Fri, 11 Aug 2017 20:23:40 GMT

Hello,

I am moving your post to the Security ISE community for better visibility and access to information.

Identity Services Engine (ISE)

Thank you for participating in the community.

Kelli Glass

Moderator for Cisco Customer Communities

Re: ISE Device Administration Service

paul — Fri, 11 Aug 2017 21:13:19 GMT

I use a single interface on all my ISE nodes except in the case where I need a Guest portal running in a DMZ. Keep things simple and use a single interface.

Re: ISE Device Administration Service

jordi.cano — Mon, 14 Aug 2017 11:31:19 GMT

Hi,

I totally agree to seek simplicity, that is the reason for my question.

Keep in mind that the AAA traffic is located in an Out-of-band network of an extensive network.

The two options I have are:

1- AAA traffic of any equipment to the ISE Management Port (same network)

2- AAA TRAFFIC of any equipment to the service port of the ISE (NAT or a New VRFfor example).

Which of the two options is most appropriate?

Best regards

Re: ISE Device Administration Service

paul — Mon, 14 Aug 2017 12:16:06 GMT

Ahh the fact that you are doing OOB management is an important piece of information not in the original post.

So assuming your ISE nodes are in the normal production network as you said you have two options:

1) You can take a 2nd interface off your ISE nodes and put them into the OOB network.

2) Allow traffic from the OOB to the normal production network for TACACS purposes only.

If there is already some mechanism in place to leak traffic from the OOB network to the production network then I would probably go #2, but if not #1 would work fine as well.