topic Re: Question about ISE MAC Database in Network Access Control

Question about ISE MAC Database

Terence Lockette — Tue, 02 Feb 2021 16:35:02 GMT

Hello all,

I hope I have the right board but wanted to ask a question about where ISE stores the MAC database for endpoints detected by ISE? Is this database part of the config backup file, operational backup file, or neither?

Re: Question about ISE MAC Database

martin.fischer — Tue, 02 Feb 2021 18:01:00 GMT

Hi @Terence Lockette

The MAC address database is part of the configuration data backup.

The configuration data backup also includes the application-specific and ADE operations system configuration data.

The operational data backup includes log / monitoring data.

Keep in mind, that certificates are NOT included in either backup.

Re: Question about ISE MAC Database

Terence Lockette — Tue, 02 Feb 2021 18:10:40 GMT

Hi @martin.fischer

I was afraid of that. We are moving from version 2.3 to 2.7 and have rebuilt the entire system from the ground up rather than restoring from backup. The reason for this is due to the bugginess of ISE 2.3 so we didn't want to risk bringing in something to the new build. However, I've decided to let the new VMs rebuild the MAC database until we're ready to put it into production.

Thanks for your response.

Re: Question about ISE MAC Database

martin.fischer — Tue, 02 Feb 2021 18:21:26 GMT

You could export the MAC addresses from the 2.3 environment to a CSV file if you want to keep them. Then put the MAC addresses and other information which you want to keep in the CSV import template and import them to the 2.7 environment.

Re: Question about ISE MAC Database

Terence Lockette — Tue, 02 Feb 2021 19:02:05 GMT

Will this contain all MAC addresses whether manually entered as well as learned by ISE?

Re: Question about ISE MAC Database

Damien Miller — Tue, 02 Feb 2021 19:12:54 GMT

If you do it through the GUI Context Visibility "export all" option, or from the PAN CLI "application configure ise" option 16 "get all endpoints", it will include all endpoints as well as their group memberships among other things.

The export and import follow different templates though so keep that in mind, you can't just export the endpoints and import the same CSV. You need to download the template from the Context Visibility endpoint import page and transpose some columns. Blank cells will be ignored.

Re: Question about ISE MAC Database

Terence Lockette — Tue, 02 Feb 2021 19:17:03 GMT

Ahhhh ok. Thanks for that insight! I will wait til the day we are ready to cut over before exporting/importing.

Thanks all!