topic Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device in Network Access Control

Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device.

wavarevivek1 — Thu, 26 Oct 2023 07:10:35 GMT

Hi,

We are having ISE 2.7 patch 9 and it is used for for endpoint posturing. For unknown clients posture reduction we have enabled the http and https redirection on cisco NAD switches.

But now we have reported http and https vulnerability from our SOC team and to disable the same.

Please suggest if there is any alternative way for redirection without enabling http & https on NAD switches or else if there is any way to use http & https without any impacting.

Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device

Rob Ingram — Thu, 26 Oct 2023 07:16:45 GMT

@wavarevivek1 there are redirectionless posture options, you'd need to predeploy the call home server list to the clients:-

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/210523-ISE-posture-style-comparison-for-pre-and.html

https://www.cisco.com/c/en/us/support/docs/security/policy-access-management/220394-implementing-ise-redirectionless-posture.html

Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device

Charlie Moreton — Thu, 26 Oct 2023 12:58:17 GMT

On IOS-XE devices that don't require access to the web UI, it is recommended to use the following commands to prevent access to the web UI while still allowing the ISE redirect use cases:

ip http active-session-modules none
ip http secure-active-session-modules none

Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device

thomas — Tue, 07 Nov 2023 00:42:07 GMT

The recommendation provided by @Charlie Moreton is documented in Cisco TAC Technical FAQs for Cisco IOS XE Software Web UI Privilege Escalation Vulnerability - CVE-2023-20198 > 3. I am using Identity Services Engine (ISE) redirect use cases and can't disable the http/https servers. What can I do?

topic Re: Cisco ISE Posture Redirection - HTTP &amp; HTTPS on NAD device in Network Access Control

Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device.

Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device

Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device

Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device

topic Re: Cisco ISE Posture Redirection - HTTP & HTTPS on NAD device in Network Access Control