topic Re: ISE PIC Support in Network Access Control

ISE PIC Support

ziyadr — Tue, 05 May 2020 14:11:27 GMT

hi there,

can someone provide a list of the supported products that ISE PIC supports?

ASA?
FTD?
ESA?
WSA
Stealthwatch Ent/Cloud?
AMP4E?
Umbrella?
etc?

Re: ISE PIC Support

Marvin Rhoads — Wed, 06 May 2020 04:54:43 GMT

Only Stealthwatch and FMC are listed in the admin guide:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/pic_admin_guide/PIC_admin26/PIC_admin26_chapter_0100.html

However any pxGrid subscriber should work - even third party subscribers such as PANW and Checkpoint are possible.

Re: ISE PIC Support

ziyadr — Wed, 06 May 2020 12:24:59 GMT

Hi there….

I think my question wasn’t worded correctly – I am not looking to use pxGrid for anything. I am looking for native integration into Cisco products using ISE-PIC as a standalone for solutions that were using CDA in the past. ISE-PIC is to replace this and has so far with lets says the WSA.

Re: ISE PIC Support

Marvin Rhoads — Wed, 06 May 2020 12:53:26 GMT

pxGrid is the mechanism via which ISE-PIC (and ISE) supports publishing of identity to other Cisco products.

See the following examples:

For WSA:

https://www.cisco.com/c/en/us/products/collateral/security/web-security-appliance/guide-c07-741643.html

For FMC/FTD:

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/control_users_with_ise_ise_pic.html

For Stealthwatch:

https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/ISE/SW_7_0_ISE_Configuration_Guide_DV_1_0.pdf

I don't believe there are any current integration options for ISE-PIC to ASA (non-Firepower), AMP for Endpoints, Umbrella or ESA.