topic Re: Need basic understand the Traffic flow between Cisco ISE <--> in Network Access Control

Need basic understand the Traffic flow between Cisco ISE <--> SMTP

ricky.kocharekar@orange.com — Wed, 09 Nov 2022 07:17:21 GMT

Need a basic understanding of the Traffic flow between Cisco ISE <-> SMTP.

Re: Need basic understand the Traffic flow between Cisco ISE <-->

Rob Ingram — Wed, 09 Nov 2022 08:14:29 GMT

ricky.kocharekar@orange.com refer to this guide, which lists which nodes communicate using SMTP and for what function/service.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/InstallGuide27/b_ise_InstallationGuide27/b_ise_InstallationGuide27_chapter_0110.html

On ISE you could run tcpdump to take a packet capture - filter on tcp/25 or smtp server IP address and generate traffic - this will confirm the traffic flow.

Re: Need basic understand the Traffic flow between Cisco ISE <-->

balaji.bandi — Wed, 09 Nov 2022 08:17:42 GMT

We are not sure what is the context here, ISE uses SMTP (or SMTP relay to send emails) depending on setup, it uses Port 25 by default. (if you looking SMTP Flow, it just like any other client who try to access SMTP EHLO--250---bla--bla---quit ---221)

if you looking for config check below :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216187-configure-secure-smtp-server-on-ise.html

Re: Need basic understand the Traffic flow between Cisco ISE <-->

thomas — Wed, 09 Nov 2022 23:02:49 GMT

This would be the authority on SMTP: https://www.rfc-editor.org/rfc/rfc5321.html