topic Re: Cisco ISE Passive Identity Question in Network Access Control

Cisco ISE Passive Identity Question

SHABEEB KUNHIPOCKER — Wed, 20 Sep 2023 14:41:26 GMT

Hello,

I have an existing ISE deployment already integrated with Microsoft AD. Now we have an ongoing implementation of Cisco WSA and there is a requirement to use ISE for transparent authentication. So should I need to purchase additional license for enabling the passive identity service on the existing ISE nodes?. I know that ISE-PIC can be installed as a standalone server, but my plan is to use the existing ISE nodes. Please advise.

Thanks

Shabeeb

Re: Cisco ISE Passive Identity Question

balaji.bandi — Wed, 20 Sep 2023 14:52:57 GMT

what version of WSA ( Async OS 15.X can integrate with ISE ) Do you have ISE/pxgrid in place ?

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa-15-0/user-guide/wsa-userguide-15-0/b_WSA_UserGuide_11_7_chapter_01000.html

Re: Cisco ISE Passive Identity Question

ahollifield — Wed, 20 Sep 2023 15:04:13 GMT

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/ise-licensing-guide-og.html

Re: Cisco ISE Passive Identity Question

SHABEEB KUNHIPOCKER — Wed, 20 Sep 2023 15:11:10 GMT

Hello,

I do not need the SGT information from ISE. I just need to use AD user and group information from ISE. My WSA version is 14.x and I think we can still integrate ISE with WSA.

Re: Cisco ISE Passive Identity Question

SHABEEB KUNHIPOCKER — Wed, 20 Sep 2023 15:13:12 GMT

Hello,

I have seen this link, but could not find what I am looking for. First thing is that the ISE deployment what we have is version 2.7. The question is whether we need additional license for enabling PIC.

Re: Cisco ISE Passive Identity Question

ahollifield — Wed, 20 Sep 2023 15:16:42 GMT

Passive ID is covered under Base licensing. Sharing with pxGrid requires Plus. Do you have enough Plus licensing to cover each of your users who you will need to share with the WSA?
Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html
Also why Passive ID at all? If you already have an ISE deployment why not use active authentication data and share that with the WSA?

Re: Cisco ISE Passive Identity Question

SHABEEB KUNHIPOCKER — Wed, 20 Sep 2023 15:37:08 GMT

Hello,

Thanks a lot for the response. I need to check that with customer. So you mean if I have 3000 users I need to have 3000 plus licenses to have passive ID?.

Re: Cisco ISE Passive Identity Question

balaji.bandi — Wed, 20 Sep 2023 15:46:05 GMT

check the compatablity matrix, base License covers your needs, make sure you have enough License ISE to integrate with WSA

Re: Cisco ISE Passive Identity Question

ahollifield — Wed, 20 Sep 2023 15:50:20 GMT

Depends which version of the licensing guide you are looking at honestly. With the 2.7 licensing statements in the admin guide 3000 Base licenses should cover your use-case since the WSA is a Cisco subscriber. However, you still need Plus licensing to enable the feature. Based on the current ISE licensing guide you need Advantage (previously Plus) licensing equal to the number of Passive ID sessions you are sharing with pxGrid.