topic Re: Cisco Identity Service Engine (ISE) in AWS cloud in Network Access Control

Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Fri, 06 Jan 2023 15:06:27 GMT

I am currently running Cisco ISE version 3.0 (running on SNS-3655) and version 3.1 (running on SNS-3415). There is a push to move this to AWS cloud in order to reduce the data center footprint. Anyone running Cisco ISE in AWS cloud can share your experience here? Both the Pros and Cons. TIA

Re: Cisco Identity Service Engine (ISE) in AWS cloud

ahollifield — Fri, 06 Jan 2023 16:34:42 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/install_guide/b_ise_InstallationGuide31/m_ISEaaS.html

Be sure to check out the Known Limitations section. Also make sure your transport between the NADs and AWS in encrypted (RADIUS DTLS, IPSec, etc). RADIUS IS NOT a secure protocol and should never be sent over the public internet. Make sure your AWS security groups / firewalls do not expose ISE to the public internet.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Fri, 06 Jan 2023 18:04:29 GMT

@ahollifield : Thanks. Look like version 3.2 is also now available on AWS market space.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Tue, 10 Jan 2023 11:46:35 GMT

@ahollifield : I don't see ISE version 3.1 in AWS marketplace, only version 3.2. Any ideas why? Especially when version 3.1 is the preferred release. Furthermore, the document you provided is for version 3.1 and yet, I can't find version 3.1 in AWS.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Marcelo Morais — Tue, 10 Jan 2023 13:41:15 GMT

Hi @adamscottmaster2013 ,

please take a look at: Cisco ISE on Cloud and also take a look at: Installing ISE 3.1 on AWS.

Note: ISE 3.2 is natively available on the Cloud Platforms: AWS, Azure Cloud and OCI.

Hope this helps !!!

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Tue, 10 Jan 2023 14:51:24 GMT

@Marcelo Morais : I guess you didn't answer my question. Where can I find Cisco 3.1 on AWS? I am NOT seeing ISE 3.1 in AWS, only 3.2

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Marcelo Morais — Tue, 10 Jan 2023 15:23:14 GMT

Hi @adamscottmaster2013 ,

you are unable to check the ISE 3.1 P1 on AWS ?

Regards

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Tue, 10 Jan 2023 15:52:08 GMT

Hi @Marcelo Morais: I only see version 3.2 in AWS marketplace. See the attached screenshot

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Wed, 18 Jan 2023 13:22:36 GMT

Can anyone from Cisco explain why ISE version 3.1 is not available in AWS marketplace? I guess not too many people is using Cisco ISE in AWS, no?

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Greg Gibbs — Thu, 19 Jan 2023 21:56:44 GMT

Both ISE 3.1 (patch1) and 3.2 are available for deployment on AWS for multiple regions. I have a customer that is deploying multiple 3.1 EC2 instances in both the US-East1 and AP-SE2 regions at the moment.

See the documentation for how to Subscribe and install AWS instances here:
https://www.cisco.com/c/en/us/td/docs/security/ise/ISE_on_Cloud/b_ISEonCloud/m_ISEaaS.html#task_psg_m1m_kqb

When building the CloudFormation template, you can specify which ISE version you want to deploy. If you prefer to use APIs or IaC tools instead of CF, you can use this same process to find the AMI ID for your preferred ISE version and region.

Example:

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Wed, 25 Jan 2023 17:18:24 GMT

I am finally able to launch ISE in AWS but only with version 3.2. I launched both ISE version 3.1 patch1 and version 3.2 using the exact same method. I am able to ssh into ISE version 3.2 but not version 3.1 Patch1. I got this error whenever I attempted to ssh into ISE version 3.1 Patch 1:

ssh -i ISE_key iseadmin@192.168.1.1
iseadmin@192.168.1.1: Permission denied (publickey).

No issue whatsoever with ISE 3.2 using the same identical key.

Any ideas?

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Greg Gibbs — Thu, 26 Jan 2023 21:38:44 GMT

ISE 3.1 and earlier use the default CLI/GUI administrator account of 'admin'. This was only changed to 'iseadmin' from ISE 3.2.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Tue, 31 Jan 2023 22:41:56 GMT

@Greg Gibbs: Yes, I did use the "admin" in 3.1 patch-1 and it still fails. see below:

ssh -i AWS_key_2023 admin@10.x.x.x
Permission denied (publickey).

I use the exact same method for ISE 3.2 and it works without issues with "iseadmin"

ssh -i AWS_key_2023 iseadmin@10.x.x.x

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Greg Gibbs — Wed, 01 Feb 2023 22:21:30 GMT

The only thing I can think of is that the keypair didn't attach correctly or something happened with the build. I have two AWS 3.1p1 instances in my lab and both work fine with my public key.

ssh -i cisco-ise-lab.pem admin@172.32.32.24
Failed to log in 0 time(s)
ise31aws1/admin#

ssh -i cisco-ise-lab.pem admin@172.32.32.132
Failed to log in 0 time(s)
ise31aws2/admin#

You might need to try rebuilding the 3.1p1 instance. If you built it using the AMI with user_data, you might try building it using the CloudFormation template instead to mitigate any potential issues with the manual user_data file.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Fri, 03 Feb 2023 18:23:22 GMT

@Greg Gibbs: I've tried to rebuilt the 3.1p1 instance multiple times without much access with the exact same method I did with 3.2. I am using the Cisco market place AMI. I do have a TAC case opened with Cisco and it said there are issues with the 3.1p1 according to Cisco internal bug document. I guess it is not yet stable in AWS, no?

Re: Cisco Identity Service Engine (ISE) in AWS cloud

hslai — Sun, 05 Feb 2023 03:54:01 GMT

@adamscottmaster2013 Likely you need wait longer.

ISE 3.1 on AWS takes ~ 25 minutes after the instance first started before we may use SSH to login. ISE 3.2 reduces this to ~ 15 minutes.

If that is not the case, please share the SR number so I may review the case notes.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Greg Gibbs — Sun, 05 Feb 2023 21:25:54 GMT

The 'issues with 3.1p1' could also be due to the many bugs that have been fixed in the 5 patches that have been released for 3.1 so far.

I have a customer that I've worked with to deploy a global ISE cluster with 3.1 (patch 5) on AWS using Terraform. They have 10 nodes in the us-east-1 region and 4 nodes in the ap-se2 region. We did not experience SSH issues with any of those nodes.

As @hslai mentioned, it takes time for the SSH login to be available. From the time the node build starts, I would give it a good 30 minutes before trying to access it via SSH or GUI.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Tue, 07 Feb 2023 23:07:51 GMT

I waited 75 minutes after the instance is launched and attempted to ssh into the ISE 3.1 p1 and still without success.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

Greg Gibbs — Wed, 08 Feb 2023 00:56:57 GMT

Are you able to access the GUI after that time? If not, there is most likely something going wrong with the build and it is not completing.

When building directly from the AMI, you should confirm that you are using only the key-value pairs and meet all the guidelines for the User Data content as defined here:
Deploy Cisco Identity Services Engine Natively on Cloud Platforms

If you have not tried building using the CloudFormation Template option, you might try that to see if it works better.

Re: Cisco Identity Service Engine (ISE) in AWS cloud

adamscottmaster2013 — Wed, 08 Feb 2023 01:24:23 GMT

@Greg Gibbs: As mentioned before, I am using THE SAME METHOD to build ISE 3.2 as I did with ISE 3.1 patch-1. ISE 3.2 has no issues but 3.1 p1 does not work. I couldn't access the GUI. Yes, I am using the same key pairs for both ISE 3.1p1 as I did with ISE 3.2. I launched both of them in the same AWS VPC and the same subnet. Only 3.2 works.

Why should I need to use CloudFormation Template option when the other option is also supported by Cisco as clearly stated in the documentation? I opened a TAC case with Cisco but the TAC doesn't seem to understand ISE in AWS. He sent me back some documentation for me to try but it is the same documentation that I attached to the ticket when I first opened the ticket. Doesn't seem like Cisco TAC engineer understand much about ISE in AWS.