topic Re: ISE Device Import in Network Access Control

ISE Device Import

Anthony Maiale — Mon, 13 Feb 2017 17:15:28 GMT

I support a customer who is attempting to deploy ISE/TACACs for device admin for the first time. They have a few questions on the device import process and to build the device repository in ISE.

Today they have 3000 devices they want to manage.

Per the ISE admin guide, they can download a csv template and fill it in with their data on their devices and then import it to ISE.

How much effort and time would it take someone to complete that process (a csv import of approx. 3000 devices)?
Are there any gotchas that you know of that I could share to help them?
Have any customers been through this process and completed it successfully? (can I share who?)
They have a majority of devices in ServiceNow today. They will export ServiceNow device repository to csv and see if it can be mapped to ISE. Do you have any info on ServiceNow to ISE mapping?

Thanks for your help.

Tony

Re: ISE Device Import

hslai — Mon, 13 Feb 2017 19:02:10 GMT

If on 3495 or 3595, importing 3K NADs should complete in 3 ~ 4 minutes. You might find it more responsive by splitting the import to 3 X 1K or 6 X 500 batches.
ISE 2.2 has a known issue in requiring RADIUS shared secret in the CSV -- CSCvc16661
I have no customer names but this is a common task.
I am not familiar with ServiceNow or whether it has a definite schema to store network devices.

Re: ISE Device Import

Anthony Maiale — Mon, 13 Feb 2017 21:17:25 GMT

OK, thank you at least this is considered common.

They are using ISE VMs, but will advise based on those appliance hardware specs for performance comparison.

Their real pain point is with the construction/entry or filling out of the spreadsheet to get it ready for import. Is there anything to help there?

We were just told to upgrade to ISE 2.2 due to hitting a couple of bugs (Deny All Shell profile does not send fail and authorization does not work in 2.1) Based on the bug that you mention above in ISE 2.2, they will be impacted on importing all of the WSA's and FirePower device since they support RADIUS only and not TACACs.

Do you know when ISE 2.2 will be patched?

Thanks.

Re: ISE Device Import

hslai — Mon, 13 Feb 2017 23:21:39 GMT

I've unicast you some more info.

Re: ISE Device Import

Ping Zhou — Tue, 14 Feb 2017 01:10:06 GMT

Could you also unicast the info you just hinted? pzhou@prosysis.com I'm also planing to import 3k NADs for both radius and T+, along with the NAD groups. I'm interested in all aspects in this regard. Thanks in advance.

Re: ISE Device Import

hslai — Tue, 14 Feb 2017 01:15:28 GMT

The bug has not been committed to a patch yet. If it important for you to get the fix, please open a TAC case and request for the hot patch.

There are two workarounds,

1. to put a dummy RADIUS shared secret for any device without it.

2. to use ISE ERS API for NAD.

Re: ISE Device Import

Arne Bier — Thu, 11 May 2017 00:49:24 GMT

On a clean install of ISE 2.2 and apply patch 1 I tested an import of a TACACS device with no Radius details - and it worked. I am curious what provokes this bug, because I have not experienced it

I would have attached my .csv but there is no option. So below is the line in the .csv that was imported without any errors.

TACACS_only_device,TACACS test client,1.1.1.1/32,,,Device Type#All Device Types|IPSEC#Is IPSEC Device#No|Location#All Locations#VM_Lab,,,,,,,,,,,,,,,,,,,,,,,,,,ENABLE_USING_COA,,,,,,,,TACACSpwd123,ON_LEGACY,Cisco,1700,FALSE,2083,

Re: ISE Device Import

hslai — Thu, 11 May 2017 00:59:13 GMT

If it regarding CSCvc16661, its fix is part of 2.2 Patch 1.