topic Re: Cisco ISE and TLSv1.3 in Network Access Control

Cisco ISE and TLSv1.3

adamscottmaster2013 — Fri, 13 Oct 2023 17:18:40 GMT

Anyone know when Cisco ISE will start supporting TLSv1.3? I am running ISE 3.2 patch-3 and it seems like TLSv1.2 is the highest it can go:

nmap --script ssl-enum-ciphers -p 443 isenode1.cisco.com
Starting Nmap 7.80 ( https://nmap.org ) at 2023-10-13 13:10 EDT
Nmap scan report for isenode1 (192.168.1.1)
Host is up (0.00068s latency).

Nmap done: 1 IP address (1 host up) scanned in 0.53 seconds

Thoughts?

Re: Cisco ISE and TLSv1.3

balaji.bandi — Fri, 13 Oct 2023 17:38:56 GMT

I heard that ISE 3.3 support TLS 1.3 worth checking release notes and configuration guide.

Re: Cisco ISE and TLSv1.3

adamscottmaster2013 — Fri, 13 Oct 2023 19:45:41 GMT

Allow TLS 1.3: Allows TLS 1.3 for administrator HTTPS access over port 443 for:

Cisco ISE Admin GUI

APIs enabled for port 443 (Open API, ERS, MnT)

Note

AAA communications and all types of internode communications do not support TLS 1.3.

Enable TLS 1.3 on Cisco ISE and the relevant clients and servers for admin access over TLS 1.3.

That's not what I want. Can it support TLSv1.3 for things besides "administration"?

Re: Cisco ISE and TLSv1.3

Greg Gibbs — Sat, 14 Oct 2023 02:51:29 GMT

What is documented is all that is currently supported. This type of enhancement requires significant development effort and regression testing, and feature roadmap is not discussed in this public forum.

Re: Cisco ISE and TLSv1.3

Arne Bier — Mon, 16 Oct 2023 20:06:52 GMT

@adamscottmaster2013 have you seen operating systems that are using 802.1X supplicants capable of TLS 1.3 ?

I have not tried this yet, but the latest WPA Supplicant has TLS 1.3 support - worth running that against ISE 3.3 to see how it handles the TLS establishment.

Re: Cisco ISE and TLSv1.3

adamscottmaster2013 — Tue, 17 Oct 2023 13:08:14 GMT

@Arne Bier: Yes, we implement 802.1x with our Xerox copiers and Xerox devices are capable of TLSv1.3 and we want to implement TLSv1.3 on ISE but the option is not available. Other vendors, beside Cisco, already support TLSv1.3.

We're going to deploy ISE 3.2 patch-3 next month. I think we will skip version 3.3 and probably switch vendor, not Cisco, the next time around.

Re: Cisco ISE and TLSv1.3

JPavonM — Tue, 24 Oct 2023 14:05:19 GMT

Here Microsoft states that Windows 11 uses TLS1.3 (WiFi Security)

Re: Cisco ISE and TLSv1.3

florian.nolting — Tue, 30 Apr 2024 20:07:47 GMT

ISE 3.3 Patch 2 now supports TLSv1.3 for Cisco ISE Workflows (and not just for the Admin GUI).