ISE 2.1 FMC 6.1 ANC Unquarantine

[Daniel Lucas]

How do you unquarantine an endpoint once FMC has instructed ISE to quarantine it? Manually entering the MAC address under 'Operations->Adaptive Network Control -> Endpoints -> EPS Unquarantine' doesn't do anything...it's also confusing because the endpoint list under Adaptive Network Control is empty:

[Daniel Lucas]

Seems like this should be something easy to do. Even deleting the endpoint out of the endpoint database doesn't remove the quarantine status.
I haven't tried creating a separate correlation policy in FMC to unquarantine the endpoint when it sees a certain connection event - mainly because that is a ridiculous way to have to unquarantine an endpoint..if you quarantine the endpoint and remove network access, how would any traffic reach the firepower appliance? And I would think the typical use-case for this feature would be to bump the endpoint off the network so an admin can run a virus scan, re-image the laptop, etc. and then get it back on the network. There has to be a way to manually unquarantine an endpoint in ISE otherwise this feature is useless.

[Daniel Lucas]

^Bump
Has anyone got this working? Is unquarantine feature available in a later release? I have customer's potentially interested in this feature, but if the endpoint is forever marked as quarantined in ISE then that would severely limit its usefulness.

[howon]

Go to Context Visibility and revoke ANC policy:

[Daniel Lucas]

Option is greyed out - is that only available when you assign an ANC policy from within ISE itself?

[howon]

Which option is greyed out? The ANC or Revoke function? If you have plus license (Which I assume you do since using RTC) it should be available to you.

[Daniel Lucas]

Sorry mis-spoke - the option isn't greyed out, but I get an error stating that "No policy applied to specified mac".

[Daniel Lucas]

Any ideas on this? If i disable my quarantine global exception rule, and re-auth I can get my endpoint back on the network - but as soon as I re-enable the quarantine rule and re-auth I match it again. It's like there is a cache that needs cleared, but I dunno how to clear it - rebooting ISE doesn't clear it either.
Is this maybe something that is available in a later version?

[Mike.Cifelli]

I have seen this same behavior before. Does ISE throw an error when doing this: Manually entering the MAC address under 'Operations->Adaptive Network Control -> Endpoints -> EPS Unquarantine' doesn't do anything? This process should work immediately if your ISE node is configured on your NAD as a dynamic author. Also, ensure that udp port 1700 (for CoA) is not blocked anywhere between ISE and your NAD. HTH!

[Daniel Lucas]

No warning or error given - I get a message saying

"Server Response

<MAC> has been saved successfully"

But when I check the log no CoA was issued - and the live session still shows my endpoint having Quarantine ANC status:

If I force a CoA from here I still see the same ANC status, and match the same Quarantine Auth Rule:

This is in a lab environment, and there is no firewall between my ISE and WLC - also CoA works it's just matching the same AuthZ policy because the ANC/EPS status doesn't change.

Let me know if there is any other configuration you would like to see.

-Thanks

[Mike.Cifelli]

What about debug logs from device?
debug aaa coa
debug radius
debug aaa pod
Can you share your AAA configs from device?

[Daniel Lucas]

It is a Wireless LAN Controller - screenshots below

Debug output after selected 'EPS Unquarantine' in ISE - no output on the WLC

Debug output after selecting 'Session Reauthentication' from 'CoA Actions' in ISE

CoA is clearing working between ISE and my NAD - it's just ISE isn't doing anything after selecting EPS Unquarantine.

[jeppich · Accepted solution]

Hey Daniel,

You would need to select EPS Unquarantine, enter the MAC address you want to unquarantine and then submit.

FMC uses Session:EPStatus:Quarantine in the ISE auth global exception policy.  This is Adaptive Network Control (ANC) 1.0. FMC subscribes to the pxGrid EndpointProtectionService Topic using pxGrid 1.0.  

FMC does not use true ANC 2.0 policies that include ISE ANC policies: quarantine, port-shut, port-bounce

You can also create an unquaratine Policy from FMC to unquarantine directly from FMC (this was from Cisco Firesight, only use the policy section):  https://community.cisco.com/t5/security-documents/how-to-rapid-threat-containment-rtc-with-cisco-firesight-and-ise/ta-p/3627044

You can also unquarantine from the API from your browser:  https://{ipaddressofmnt}/API/eps/UnQuarantineByIP/{ipaddress}

If you have any questions, please email me directly.

Thanks,

John

jeppich@cisco.com

[Daniel Lucas]

The API call worked - although for anyone else having this issue a username is required in the GET request, and also ERS needs enabled in ISE (Administrator->Settings->ERS)
http://<ise-ip>/admin/API/eps/UnQuarantineByIP/<endpoint-ip>

Thanks for the help

[vaguirre17]

Hello guys.

But is there any way to see which devices are in quarantine mode? I could unquarantine using the EPS unquarantine buttom but how I could know which other devices are currently quarantined? I need track it.

Thanks