topic Re: Query Regarding Endpoint Visibility via Cisco ISE in Network Access Control

Query Regarding Endpoint Visibility via Cisco ISE

snbw16 — Mon, 14 Jul 2025 06:55:17 GMT

Certainly! Here's a rephrased version of your message in a more formal and concise tone:

Subject: Query Regarding Endpoint Visibility via Cisco ISE

Hello All,

In our environment, CLI access for network devices (switches, routers, etc.) is authenticated using TACACS+ through Cisco ISE. I would like to understand whether Cisco ISE can provide visibility into the number of endpoints currently connected to the switches.

RADIUS authentication for endpoints is handled by a separate solution. Kindly advise on this.

Re: Query Regarding Endpoint Visibility via Cisco ISE

Torbjørn — Mon, 14 Jul 2025 07:24:54 GMT

This should be possible by sending radius accounting to ISE, though I must admit that I have never tried this myself and can't find any examples of this on the web. Please report back if you do try this though!

Re: Query Regarding Endpoint Visibility via Cisco ISE

wajidhassan — Mon, 14 Jul 2025 09:58:35 GMT

Hi @snbw16 ,

Cisco ISE primarily handles authentication and authorization (TACACS+ for device admin access, RADIUS for endpoint access) but does not directly provide detailed visibility on the number of endpoints connected to switches.

For endpoint visibility, you typically need to integrate ISE with network devices and use features like SNMP polling, NetFlow, or Cisco DNA Center, which can collect endpoint information from switches.

So, while ISE controls access, detailed endpoint counts and visibility usually come from complementary network management or monitoring tools.

Hope this helps!

Re: Query Regarding Endpoint Visibility via Cisco ISE

Arne Bier — Mon, 14 Jul 2025 20:29:40 GMT

That questions sounds like a reply from a chatbot. But regardless, you can use a standalone ISE to poll switches to extract the endpoints (MAC addresses). This would require you telling ISE what all you switches are, and enabled SNMP on them to allow ISE to run a scan against. It's an audit option for customers to get an insight into a point-in-time endpoint status.