topic Re: ISE Third party support in Network Access Control

ISE Third party support

FraserJohnston62763 — Mon, 23 Nov 2020 10:49:49 GMT

Hi there, and thank you for reading.

Been out of IT infrastructure for a number of years and struggling to get up to speed rapidly.

Im looking at an existing ICE system supporting AAA/ Profiling/BTOD/Guest/Posture services.

We are looking to add some third party switch hardware and door access/cctv endpoints, which we want to be complient with ICE. Am I understanding correctly that the switches just need to support 802.1X, or that need to support 802.1X and have RADIUS and TACACS integration built in?

Do I also understand correctly that ICE can have exceptions for certain nodes and endpoints if there are compatibility issues, but any new devices added to those nodes, a bad actor or such would still be blocked by ICE?

Many thanks in Advance

Fraser

Re: ISE Third party support

Mark Elsen — Mon, 23 Nov 2020 12:12:50 GMT

- Check below link for examples :

https://community.cisco.com/t5/security-documents/ise-third-party-nad-profiles-and-configs/ta-p/3648719

Re: ISE Third party support

balaji.bandi — Mon, 23 Nov 2020 12:48:19 GMT

here is the device matrix based on the version of ISE you running

https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-device-support-tables-list.html

Re: ISE Third party support

Mike.Cifelli — Mon, 23 Nov 2020 13:36:08 GMT

On top of the links provided take a peek at the ISE Resources links at the top of the 'Network Access Control' community forum as there are really good examples and guides there. Also, for free tutorials for ISE config demos take a look at: Video: Security | Lab Minutes

Am I understanding correctly that the switches just need to support 802.1X, or that need to support 802.1X and have RADIUS and TACACS integration built in?

-Yes. Devices will need to be able to support dot1x and radius. Radius is used between the authenticator (switch) and ISE (authentication server). Note there are specific licenses (Base) needed to support your typical AAA services.

-Yes. You will utilize your policy sets to steer policy and allow (authorize) good known clients onto the network. Bad actors should not match any policies and hit the default policy which should be secured (deny access).

HTH!