topic Re: PAN in Network Access Control

PAN & ISE for Rapid Threat Containment

ankaushi — Fri, 12 May 2017 02:09:17 GMT

Hi Team,

I understand that we have a list of ecosystem partner for pxGrid and PAN is not listed there. Do we have any case study or any partner for reference who has done the ISE integration with PAN for Rapid Threat Containment…or any document which talks about the integration of Cisco ISE with Palo Alto Firewall for RTC.

Though I could find a link (http://www.cisco.com/c/en/us/products/security/pxgrid.html ) where it mention “With pxGrid, any connected technology can instruct the Cisco Identity Services Engine (ISE) to contain a threat," but was not able to find the some specific information related to Palo Alto Firewall. Any caveats???

Re: PAN & ISE for Rapid Threat Containment

Timothy Abbott — Fri, 12 May 2017 17:38:02 GMT

Anshul,

We haven't tested PAN with ISE for RTC. My understanding is the integration is limited to ISE sending syslog information for PAN to ingest. Unfortunately, we don't have any documentation that covers how to set this up.

Regards,

-Tim

Re: PAN & ISE for Rapid Threat Containment

hslai — Fri, 12 May 2017 17:38:38 GMT

There is no current support. Please discuss your use cases with our product management teams.

Re: PAN & ISE for Rapid Threat Containment

Kevin Xiong — Wed, 15 Nov 2017 16:13:17 GMT

Can ISE BU test this PAN with ISE integration ASAP and publish some example documentation? This will certainly help partners to position ISE for all identity related management.

I have a customer who use PAN for URL filtering. They enable PAN SSL Decryption for URL Filtering. All Group membership are out of active directory. They're trying to fetch group data via SAML on ADFS. PAN can only use LDAP for Group mapping for User-Identification.

Can we position ISE pxGrid to make this user-id mapping work for PAN URL filtering?

Re: PAN & ISE for Rapid Threat Containment

Jason Kunst — Wed, 15 Nov 2017 16:20:07 GMT

Again as hslai stated please reach out to ISE product management team thru the sales channel with your use case.

Re: PAN & ISE for Rapid Threat Containment

tminh — Mon, 01 Oct 2018 07:44:56 GMT

Hi all,

Any update about posibility of having PAN "talking" to our ISE via PxGRID?

I have customer who concerns this issue.

Rgds,

Minh

Re: PAN

Jason Kunst — Mon, 01 Oct 2018 10:44:21 GMT

Recommend you ask PAN (assume you mean Palo Alto networks?) it’s up to them to integrate

Re: PAN

tminh — Tue, 02 Oct 2018 06:36:08 GMT

Thanks for your advice.

Asking PaloAlto SE, I got the following answer:

- PA FW could use PxGRID to send to ISE quarantine request

- PA FW could get the user information from ISE indirectly with the help of a free tool MineMeld + PxGRID

Minh

Re: PAN

Jason Kunst — Tue, 02 Oct 2018 11:43:51 GMT

>From our integration explorers. there is no current integration, please reach out to PAN to adopt Open pxGrid.

Re: PAN & ISE for Rapid Threat Containment

waqas1 — Fri, 12 Apr 2019 08:20:26 GMT

Hi Everyone,

I have the same problem with the Fortigate FW. Does anyone know how to integrate Fortigate FW with the Cisco ISE for RTC?

Thanks

Waqas

Re: PAN

Jason Kunst — Fri, 12 Apr 2019 12:33:06 GMT

Same guidance, if not listed under http://cs.co/ise-guides then we likely don’t have integration. You would need to have customer request feature from vendor to integrate with our product, it’s open platform sdk

https://developer.cisco.com/site/pxgrid/

Re: PAN

nidamen — Thu, 19 Dec 2019 06:18:25 GMT

Panorama Plugin for Cisco TrustSec....

Maybe in the near future we could get Rapid Threat Containment working! Was a dream thought before with PA but looking like reality soon!

Re: PAN & ISE for Rapid Threat Containment

Emre Ozel — Fri, 27 Mar 2020 10:37:47 GMT

Hi Guys,
I have read a lot of articles about Palo Alto Cisco ISE and now I understand that I can do this through MineMeld.
A pxgrid configuration is required on the Cisco ISE side.
I will prepare a document of interest soon.

Re: PAN & ISE for Rapid Threat Containment

nidamen — Thu, 01 Apr 2021 18:30:19 GMT

Emre did you ever get around to doing a Document which covered this?