topic Re: Cisco ISE 2.4 EndPoint API Creation in Network Access Control

Cisco ISE 2.4 EndPoint API Creation

BrandonSharp37516 — Thu, 18 Mar 2021 21:36:32 GMT

Hi Everyone,

I'm trying to get some clarification on the ISE REST API. Right now, if I import an endpoint from CSV, then use the API to GET the endpoint I see the following.

{
    "ERSEndPoint": {
        "id": "someID",
        "name": "11:11:11:11:11:11",
        "mac": "11:11:11:11:11:11",
        "profileId": "2222222-d10b-11e9-8b5f-2222222",
        "staticProfileAssignment": true,
        "groupId": "1111111-c830-11e9-8b5f-1111111",
        "staticGroupAssignment": true,
        "portalUser": "",
        "identityStore": "",
        "identityStoreId": "",
        "link": {
            "rel": "self",
            "href": "https://mysever:9060/ers/config/endpoint/name/11:11:11:11:11:11",
            "type": "application/json"
        }
    }
}

This is fine, now I want to use the API to insert the same device. So I copy this to a text file, delete the endpoint in ISE and run a POST with this payload.

{
    "ERSEndPoint" : {
        "mac" : "11:11:11:11:11:11",
        "groupId" : "11111111-c830-11e9-8b5f-11111111",
        "staticGroupAssignment" : true,
        "staticProfileAssignment" : true,
        "profileId": "2222222-d10b-11e9-8b5f-22222222"
    }
}

This returns 201, but when I go to the GUI to inspect, it's missing it's EndPoint Policy and it's EndPoint Profile. My question is, is this normal? What fields am I missing?

EDIT: For clarification this is the csv format I'm using to upload.

MACAddress	        EndPointPolicy	        IdentityGroup
11:11:11:11:11:11	EIG-MyComp-Printer	EIG-MyComp-Printer

Re: Cisco ISE 2.4 EndPoint API Creation

Greg Gibbs — Thu, 18 Mar 2021 22:17:34 GMT

There are values like 'name' and 'id' that are required attributes. See the REST API SDK for a table listing required/optional attributes and other examples.

You might also have a look at ISE ERS API Examples

Re: Cisco ISE 2.4 EndPoint API Creation

BrandonSharp37516 — Thu, 18 Mar 2021 23:36:34 GMT

Hi Greg,

Thanks for responding. I have viewed the link and the ERS SDK. The problem I am having is around creating the endpoint with API vs CSV. The two images I attached should make it clearer. I upload a file with 3 fields, and I use the rest API with the same fields and get different results.

REST EXAMPLE

CSV EXAMPLE

Re: Cisco ISE 2.4 EndPoint API Creation

Greg Gibbs — Fri, 19 Mar 2021 00:17:55 GMT

So, if I understand correctly, you're trying to use the same CSV file for both file import as well as the REST API. Unless I'm mistaken, that is not possible as those methods use different attributes for the Profiler policy.

The file import template uses "EndpointPolicy" whereas the ERS API uses "staticProfileAssignment" and the relevant "profileID" associated with that Policy.

Re: Cisco ISE 2.4 EndPoint API Creation

BrandonSharp37516 — Fri, 19 Mar 2021 00:25:14 GMT

I think we're on the same page, I want to replicate what users were doing with the CSV, with a REST API. I am trying to find API endpoint/parameters to replicate the "Import File" dropdown under Context Visibility => Endpoints => Import from file. Is that something that is going to be supported? It seems like a valid use case. Is there no programmatic way to associate an endpoint that was create via REST with a EndPointPolicy?

Thanks a ton for your help,

Brandon

Re: Cisco ISE 2.4 EndPoint API Creation

Greg Gibbs — Fri, 19 Mar 2021 01:16:40 GMT

This is not so much of a product issue, but more of a coding one. You can certainly create single or bulk endpoints via API and map them to a specific Profiling policy using JSON/XML.

If you want to use a CSV file for your source info, you would likely need to look at coding that via Python. This discussion seems pertinent to what you are looking to do:

https://community.cisco.com/t5/network-access-control/ise-ers-api-import-endpoints-from-xml-or-csv-file/td-p/3833703

Re: Cisco ISE 2.4 EndPoint API Creation

BrandonSharp37516 — Fri, 19 Mar 2021 01:28:16 GMT

Hi Greg,

I am not looking to use the CSV, but replace it. You mention map them to a specific profiling policy with JSON.... where do you see this? I show above that I am assigning a profileID in my POST, however it's not showing up.

Re: Cisco ISE 2.4 EndPoint API Creation

Greg Gibbs — Fri, 19 Mar 2021 02:01:11 GMT

Sorry Brandon, I was misunderstanding what you were trying to do. I tested the same in ISE 3.0 p2 and it worked fine via JSON. I suspect you're running into a bug in 2.4.

If you're not at the latest patch (patch 13), you might be hitting this bug - CSCvr68432

If you're already using patch 13, you might need to open a TAC case to investigate further.

Re: Cisco ISE 2.4 EndPoint API Creation

BrandonSharp37516 — Fri, 19 Mar 2021 02:08:53 GMT

Thanks Greg, I will work with my team to start the patching process.

Best,

Brandon