topic Re: Query on APIs to Fetch Specific Fields from ISE in Network Access Control

Query on APIs to Fetch Specific Fields from ISE

jagritibhardwaj471 — Thu, 28 Nov 2024 03:54:29 GMT

I need to fetch specific data fields from Cisco ISE. Could you please guide me on the appropriate APIs or endpoints that can be used to retrieve the following information?

NAS Port
NAS IP
NAS Type
Location
Network Device Details
Authorization Profile
Reason for Non-Compliance (if the posture status is Non-Compliant)

Additionally, I would appreciate any documentation or examples of API requests and responses that could assist in implementing these queries effectively.

Re: Query on APIs to Fetch Specific Fields from ISE

JPavonM — Thu, 28 Nov 2024 07:06:24 GMT

Check this is out:
https://www.postman.com/lunar-module-astronomer-52086722/cisco-ise/collection/ks7b1cf/cisco-ise-api-policy

Re: Query on APIs to Fetch Specific Fields from ISE

jagritibhardwaj471 — Fri, 29 Nov 2024 05:41:38 GMT

Hey, i think i wasnt clear enough i want these components , to be fetched that appear in radius live logs these above listed ip's dont help me with that ? maybe any other api?

NAS Port
NAS IP
NAS Type
Location
Network Device Details
Authorization Profile
Reason for Non-Compliance (if the posture status is Non-Compliant)

Re: Query on APIs to Fetch Specific Fields from ISE

jagritibhardwaj471 — Mon, 02 Dec 2024 05:24:51 GMT

Hey,

For this api :

https://10.215.26.83:443/api/v1/policy/network-access/authorization-profiles what value are we supposed to pass in the headers ? What is a X-Request-ID?

Re: Query on APIs to Fetch Specific Fields from ISE

thomas — Mon, 02 Dec 2024 23:51:58 GMT

You did not explain your desired goal or scenario but you have 2 options.

First is the ISE MNT APIs for active session details however these are only valid for active sessions - not all historical - and only return XML. See :

▷ How to Get Data Out of ISE

25:04 Demo: ISE REST APIs with curl and Python Scripts | ISE ERS API Examples | ISE Monitoring API Examples

Second - and my recommended approach - would be to not use REST APIs and instead to use the ISE 3.2+ Data Connect feature with an ODBC client to get the values or create queries/reports.

▷ How to Get Data Out of ISE

48:32 ISE Data Connect
OpenAPI: https://cs.co/ise-api#!data-connect-openapi
Guides: https://cs.co/ise-dataconnect
iseql.py: https://github.com/1homas/ISE_Python_Scripts/blob/main/iseql.py
52:07: Demo: ISE Data Connect SQL Queries

And use my iseql.py script or preferred ODBC tool and my many saved SQL queries to get what you need:

❱ iseql.py "$(cat data/SQL/radius_auths_example.sql)" -it -f table

radius_auths_example.sql:

SELECT TO_CHAR(timestamp, 'YYYY-MM-DD HH24:MI:SS') AS timestamp, -- drop fractional seconds calling_station_id, username, device_name, nas_ip_address, nas_port_id, nas_port_type, location, -- NDG policy_set_name, -- Default, Wired, etc. authorization_profiles AS authz_profiles, -- ⚠ Blank for failed auths! posture_status FROM radius_authentications WHERE timestamp > sysdate - INTERVAL '1' HOUR -- last N hours ORDER BY timestamp ASC -- first/oldest records

There is no API or field for Reason for Posture Non-Compliance. Make a Wish for that @ https://cs.co/ise-wish

Re: Query on APIs to Fetch Specific Fields from ISE

stephan.l.martin1 — Mon, 02 Dec 2024 23:13:16 GMT

Adding to this- I know there are current plans to release some additional API features in the future which is associated with DoD Comply-to-connect requirements. As far as I am aware this change will incur additional license requirements. I explicitly looked to identify posture information from ISE in which this was not possible given the currently available APIs. As @thomas may be more aprised of the situation I would certainly look at following his recommendation in the meantime.

Re: Query on APIs to Fetch Specific Fields from ISE

thomas — Mon, 02 Dec 2024 23:56:22 GMT

The ISE Data Connect tables

will be very helpful by providing FAILURE_REASON and many other fields per endpoint posture assessment.

No additional licensing required.

Re: Query on APIs to Fetch Specific Fields from ISE

jagritibhardwaj471 — Tue, 03 Dec 2024 05:57:59 GMT

Hey Thomas,

So basically my goal is to fetch fields for live data and store them in a database I have created,

these fields u can check by opening the UI of ISE and then Operations > Radius > Live Logs,

then in that , under the details column you open the authentication report .In that report,

Now the fields i want the data for are:

--> Under the section Authentication Details:

Username, Endpoint Id, Endpoint Profile, Calling Station Id , Network Device , Location ,Authorization Profile

-->Under the section Other Attributes :

Device IP Address, cisco-nas-port ,Location, network device profile.

So , using dataconnect feature can i fetch these ???

Also we are using golang on backend , will it be compatible with the dataconnect feature?

Re: Query on APIs to Fetch Specific Fields from ISE

jagritibhardwaj471 — Tue, 24 Dec 2024 09:41:59 GMT

Hey, i am facing an error while trying to connect to ise db after enabling the data connect feature .

The code is:

package main

import (

"database/sql"

"fmt"

"log"

_ "github.com/sijms/go-ora/v2" // Oracle DB driver

)

func main() {

// Define the connection string for Oracle with SSL/TCP

dsn := `dataconnect/password@tcps(1.1.1.1:2484)/cpm10?ssl=true&ssl_cert=<path_to_cert>`

// Open a database connection using the go-ora driver

db, err := sql.Open("oracle", dsn)

if err != nil {

log.Fatalf("Failed to open connection: %v", err)

}

defer db.Close()

// Try to ping the database to check connectivity

err = db.Ping()

if err != nil {

log.Fatalf("Failed to ping database: %v", err)

} else {

fmt.Println("Successfully connected to the Cisco ISE Database!")

}

// Sample query: List Network Device Groups

rows, err := db.Query("SELECT * FROM NETWORK_DEVICE_GROUPS")

if err != nil {

log.Fatalf("Error executing query: %v", err)

}

defer rows.Close()

// Print query results

fmt.Println("\nList of Network Device Groups:")

for rows.Next() {

var id, name, status string

err := rows.Scan(&id, &name, &status)

if err != nil {

log.Fatalf("Error scanning row: %v", err)

}

fmt.Printf("ID: %s, Name: %s, Status: %s\n", id, name, status)

}

if err := rows.Err(); err != nil {

log.Fatalf("Row iteration error: %v", err)

}

the error i am facing is :
2024/12/24 15:11:16 Failed to ping database: missing port in address