topic Re: Cisco ISE Creating Policy using ERS in Network Access Control

Cisco ISE Creating Policy using ERS

chebbah — Mon, 03 Apr 2023 14:36:14 GMT

Hi !!

I want to ask if can we create conditions or policy rules using ERS,

if we don't, should I write a script python to do this via postman.

Re: Cisco ISE Creating Policy using ERS

Charlie Moreton — Mon, 03 Apr 2023 14:54:14 GMT

In ISE 3.1 the addition of Open API allows for Policy to be created/deleted/updated via API.

https://developer.cisco.com/docs/identity-services-engine/latest/#!versioning/versioning

Re: Cisco ISE Creating Policy using ERS

thomas — Mon, 03 Apr 2023 21:41:36 GMT

All ISE APIs are documented @ https://cs.co/ise-api and in the ISE PAN node for ISE 3.1+ via the built-in Swagger UI utility.

CiscoISE on GitHub: https://github.com/CiscoISE

Python : ciscoisesdk Package | API Docs | Repository
Ansible : cisco.ise Modules | Documentation | Repository
Go : isegosdk SDK | Documentation | Repository
Terraform : Registry | Documentation | Repository

Re: Cisco ISE Creating Policy using ERS

thomas — Mon, 03 Apr 2023 21:48:19 GMT

One of our Security Architects has done it with Ansible & Terraform:

https://github.com/grg1bbs/Ansible_ISE_Policy_Set_MM_LIM

https://github.com/grg1bbs/Terraform_ISE_Policy_Set_MM_LIM

Re: Cisco ISE Creating Policy using ERS

Greg Gibbs — Tue, 04 Apr 2023 00:07:27 GMT

Just be aware that there is currently not full feature parity between the GUI and API. While you can use the API and IaC tools to configure some Policy elements, it is typically just a starting point. The remaining policy elements would need to be configured via the GUI.

Re: Cisco ISE Creating Policy using ERS

chebbah — Tue, 04 Apr 2023 09:50:22 GMT

Thank you for your reply, I'm using 2.4.0.357, is it possible with it.

Re: Cisco ISE Creating Policy using ERS

Charlie Moreton — Tue, 04 Apr 2023 11:29:42 GMT

@chebbah, no, it is not possible with ISE 2.4.

Also, note that the version you are using reached Last Date of Support on December 26, 2022, so please consider upgrading to s supported version.

End of Life Announcement for the Cisco Identity Services Engine Software Version 2.4

Re: Cisco ISE Creating Policy using ERS

chebbah — Tue, 04 Apr 2023 12:18:08 GMT

Noted , Thank you

Re: Cisco ISE Creating Policy using ERS

andriio — Sun, 03 Dec 2023 15:11:20 GMT

Hi Thomas
it looks like ciscoisesdk runtime constatntly fails for python env >=3.12 with "ModuleNotFoundError: No module named 'imp'"

Re: Cisco ISE Creating Policy using ERS

euahmed — Tue, 08 Oct 2024 14:25:11 GMT

Hi Greg ,

Please can you share you inputs to how to create Network Device policy set using POST REST API call in postman and do the custom modification in the body .

I have taken this below request from swagger-ui and trying to do some modification using POSTMAN POST API call . But I am not able to create policy using POSTMAN and getting below Error .

Do you suggest me how to get resource-id in POST API call for new policy set creation,

Request API call for creating new policy set in ISE :

{
"condition": {
"conditionType": "ConditionAttributes",
"isNegate": false,
"link": {
"href": "https://{{ISE_IP}}/api/v1/policy/{{protocol}}/policy-set/{{resource-id}}",
"rel": "self",
"type": "application/json"
}
},
"description": "My Description",
"isProxy": false,
"link": {
"href": "https://{{ISE_IP}}/api/v1/policy/{{protocol}}/policy-set/{{resource-id}}",
"rel": "self",
"type": "application/json"
},
"name": "My_policy_set 1"-Customized policy set",
"rank": 0,
"serviceName": "Default Network Access",
"state": "enabled"
}

Getting Error for above request :

{
"message": "condition.operator, may not be null, condition.dictionaryName, may not be null, condition.attributeValue, may not be null, condition.attributeName, may not be null",
"code": 400
}

with regards

Erfan