topic Re: ISE cleaning unused objects/devices in Network Access Control

ISE cleaning unused objects/devices

valentinrosic — Wed, 28 Jun 2023 09:47:17 GMT

Hello,

I'm currently in process of migrating old ISE 2.7 to ISE 3.1. Old ISE is actually filled with garbage from old ACS.

Do you have any recommendations how to find and clean unused/obsolete:

1. TACACS/RADIUS: network devices and device admin policy sets

2. Network access: policy elements (authorization profiles, downloadable ACL's, etc.)

Re: ISE cleaning unused objects/devices

Aref Alsouqi — Wed, 28 Jun 2023 11:45:46 GMT

Try please to look at Operations > Reports, you might find some useful reports templates in there.

Re: ISE cleaning unused objects/devices

valentinrosic — Wed, 28 Jun 2023 15:15:38 GMT

Hello Aref,

I'm aware of Reports but unfortunately I'm unable to generate anything that's usefull to me. That's why I created this post.

Re: ISE cleaning unused objects/devices

Nancy Saini — Wed, 28 Jun 2023 17:21:20 GMT

There is no tool to clear unused network devices and policy elements.

For the policy elements, you may try deleting it manually, if it gets deleted without any error that means it's not being referred in any policy.

Re: ISE cleaning unused objects/devices

valentinrosic — Wed, 28 Jun 2023 18:44:05 GMT

Thank you Nancy.

We have script which daily uses ssh to login to the device and to copy running configuration to linux server.

Is there possibility of creating report which will tell me which network devices werent accessed for last month or were timedout?

Re: ISE cleaning unused objects/devices

Nancy Saini — Thu, 29 Jun 2023 18:06:52 GMT

You can check last 30 days RADIUS/TACACS authentication report on ISE and filter by network device name to check which devices were logged in.

Re: ISE cleaning unused objects/devices

hslai — Tue, 13 Feb 2024 02:28:50 GMT

@valentinrosic The hit for each policy set and policy rule should help identify which policy set or rule is actively used. Once the policy sets are clean, then we may tackle the policy elements. Exporting the policies to an XML file might help with that.