PXGRID integration with FMC-use case

[Muhammad Azhar]

Dear Experts,

I am going to integrate Pxgrid in distributed environment. I have few points to clarify.

• I have 2xPAN, 2xMnt and multiple PSNs, I am going to add two Pxgrid in setup. Currently i am using Self sing cert.
• Keeping this in mind what will be the best case for certificates to integrate with Pxgrid and FMC , Is all PSNs certificate will be added into PxGrid or only PAN and MNT is will be add in Pxgrid ? Please suggest the correct way.
• What can be use case if i have IPS license in my FMC ?  I am not clear about the use case?
• Please note i am going to use ISE 2.3 upgrade version for integration.

Appreciate your feedback and thanks in advance.

[Mohammed al Baqari]

As you know, ca signed certs are more secure that self signed. Now in
pxgrid you can use self signed technically but you need the ca cert
imported in fmc. Only MNT, PAN and PxGrid certs are replicated. You don't
need specific licenses for pxgrid on fmc. IPS lic will work

[Muhammad Azhar]

Thanks Mohamad for the reply.



What about the FMC use case ? as per my understanding user who trigger the IPS will be put in isolated vlan ? But I am not clear about the use case. Can you explain if you have any idea on this.

[Mohammed al Baqari]

This is called rapid threat containment you can read about it in ise
guides). The concept as you mentioned that once an IOC is detected in FMC
for user, fmc will notify ise through pxgrid and ISE will drop a CoA to
NAD in order to isolate the endpoint of that user

***** please rate useful posts

[Muhammad Azhar]

Thanks for your replay.



I will look into the document related to threat containment , do you have any reference document and use case example from where I can understand in better way.

[Mohammed al Baqari]

This might help

https://community.cisco.com/t5/security-documents/how-to-rapid-threat-containment-rtc-with-cisco-firesight-and-ise/ta-p/3627044

**** Please remember to rate useful posts