topic Re: ISE Encryption Questions in Network Access Control

ISE Encryption Questions

Wade Vick — Mon, 12 Dec 2016 19:28:52 GMT

I have some questions about the traffic flows for ISE and encryption.

Source : All ISE Nodes

Destination : All ISE Nodes

Port : TCP 12001

Purpose : ISE Configuration replication

Question : Is this over TLS?

Source : All ISE Nodes

Destination : All ISE Nodes

Port : TCP 7802

Purpose : ISE Configuration replication

Question : Is this over TLS?

Source : Admin&Mon

Destination : Admin&Mon

Port : TCP 1528

Purpose : Oracle DB (Secure JDBC)

Questions : Is this over TLS? Need to understand what "secure" means.

Re: ISE Encryption Questions

Craig Hyps — Tue, 13 Dec 2016 00:31:44 GMT

JGroups communications over TCP/12001 (global JGroup channel) and TCP/7800 and 7802 (Local JGroup Cluster) all occur over TLS 1.2. Oracle communications over JDBC are also secured via TLS. All current (patched) versions of ISE should address current SSL vulnerabilities including the use of TLS to secure internode communications. Depending on the service, there are some options to deliberately allow weaker protocols and ciphers for backwards compatibility, for example TLS 1.0 or SHA-1 user, but default should be secure (disallow SSL).

/Craig

Re: ISE Encryption Questions

Nadav — Fri, 02 Nov 2018 15:27:55 GMT

Hi,

Sorry to wake up an old thread, but which certs are used for the encryption? The certs imported as part of adding the nodes to the primary PAN?

If I wanted to use my own certs from a private CA, is there a guide for this?

Thanks!

Re: ISE Encryption Questions

hslai — Sat, 03 Nov 2018 17:16:56 GMT

The certificates designated with the usage "Admin".