topic Re: ISE ports in Network Access Control

ISE ports

nikhilcherian — Sat, 27 May 2017 08:28:51 GMT

Hi All

I am little confused on the port number 8905 for ISE communication, can you help me

The administration guide says the ISE node is discovered on port 80 first & then on port 8905. If the port 80 discovery goes fine, will the anyconnect still try for port 8443
The ISE installation guide says " Provisioning - NAC Agent Update Notification: UDP/8905 (SWISS) & Provisioning - NAC Agent and Other Package/Module Updates: TCP/8905 (HTTPS)". If I have already installed the latest posture agent in the client PC, will I still use port 8905
The ISE installation guide also says " Assessment - Posture Negotiation and Agent Reports: TCP/8905 ". But this is mentioned as https traffic. If I sniff, can I see this traffic

Regards

Nikhil

Re: ISE ports

Craig Hyps — Sat, 27 May 2017 15:49:51 GMT

HTTPS over TCP/8905. SWISS is no longer used in ISE since 1.3. Port 80 is only used for the initial redirect to PSN at which time communication is redirected to 8443 and then to 8905. If current guides reference SWISS, then please provide link and we will get updated.

Craig

Re: ISE ports

nikhilcherian — Sat, 27 May 2017 16:41:10 GMT

Hi Craig,

Thanks for the reply, I still see the SWISS ports in the below link

Cisco Identify Services Engine Hardware Installation Guide, Release 2.0 - Cisco ISE Ports Reference [Cisco Identity Se…

If the communication on TCP/8905 in HTTPS if I sniff the packet in the PC, can I see the port 8905

Regards

Nikhil

Re: ISE ports

hslai — Mon, 29 May 2017 00:22:43 GMT

Yes, if you setup a wired sniffer on the PC, you should be able to see the attempts to TCP/8905 encrypted by the ISE PSN admin certificates.

ISE 2.2 along with AC 4.4 and CM 4.2 have the option to use the "Call Home List" in the AnyConnect ISE posture module/agent profile and to specify the client provisioning portal port(s) instead of 8905.

Re: ISE ports

nikhilcherian — Wed, 31 May 2017 10:25:07 GMT

Thanks for the replies.. In my setup I can see the ISE showing the posture status as a compliant & client gets the CoA, but I don't see any traffic on port 8905. All I can see is traffic on port 8443. I can also see the client getting my Posture conditions in the scan summary, client validating the posture conditions & moving to posture compliant state.

However no traffic on port 8905, how can I ensure the working is correct

Regards

Nikhil