topic Re: Discover network device from ISE in Network Access Control

Discover network device from ISE

ignacio.sanchez — Wed, 26 May 2021 09:15:27 GMT

Hi,

We use our ISE only as "Devide Admin" and we do not have the "Network Device" in the database, we have the default device enabled.

Now we need to apply policies based on the device type. We do not know all the devices that connect to the ISE. Is there a way to add the network devices discovering them automatically from the ISE itself?

I would be appreciated if someone guides me in this regard.

Re: Discover network device from ISE

balaji.bandi — Wed, 26 May 2021 09:46:41 GMT

If this is used for only Device admin, you can add them put them in discovery mode, and make them according to the requirement to based on the area and profiles

you can cattegorise, like switches,. Routers, make a users to access what level access rquired, Full admin or only certain access restrictions and so on.

https://community.cisco.com/t5/security-documents/how-to-create-ise-network-access-device-profiles/ta-p/3631103

Re: Discover network device from ISE

ignacio.sanchez — Wed, 26 May 2021 10:16:24 GMT

Thanks for answering so quickly.

I need to identify the network device by manufacturer, Cisco, Juniper, Huawei, etc, but I still can't understand how to do it if I can't create the network device and indicate the manufacturer.

The truth is that since I do not know the IP I cannot create it and also in the same network there may be several manufacturers.

Re: Discover network device from ISE

balaji.bandi — Wed, 26 May 2021 11:54:21 GMT

You need to do network discovery, get some time read the document it has the process, you do not required to mass network discovery, you can do small subnet.

Re: Discover network device from ISE

thomas — Wed, 26 May 2021 15:12:03 GMT

Since you have the Default Network Device option configured, you may now look in your logs and reports for your specific network device IP addresses. You will need to spend the time to login to each one and determine the vendor / model / OS version.

Alternatively, you may use the built-in ISE Visibility Setup to scan your network(s) for network devices based on the SNMP Community.

It will scan for your network devices but you must know the SNMP Community string(s):