Cisco ISE 2.4. TLS 1.2

[ccg-security]

Hello Team,

We would like to know if Cisco ISE 2.4 can support tls 1.2?. if NOT, any documents?

[Jason Kunst]

Please check the release notes


https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/release_notes/b_ise_24_rn.html

[ccg-security]

Based on the link that you provided is for ISE to be the client only, however we need to disable the tls 1.0 and 1.1 for ISE to be the host. If we uncheck the tls 1.0 and 1.1, it will automatically use 1.2?

[Jason Kunst]

By unchecking tls 1.0 & 1.1 it will only use 1.2, please see the note in the admin ui

[ccg-security]

Hi based on the documents that the ISE acts a client not on server. We are pointing to the ISE Server itself.

What is New in Cisco ISE, Release 2.4
The Default TLS Version when initiating External Connections through Proxy is TLS 1.2
When the Cisco ISE acts as a client, the default protocol used for the connections initiated from it to the external entities is TLS 1.2 In this case the supported protocol will be TLS 1.2 only. In case you want to provide support for lower versions as well (which might be insecure), these versions need to be explicitly enabled from the Cisco ISE by going to the following page: Administration > System > Settings > Security Settings.

[ccg-security]

We also tried to access on the ISE 2.4 version, however it seems that TLS 1.2 can’t be allowed on the Security settings . With all the above mentioned, If TLS 1.2 is confirmed supported on the ISE 2.4 and with ISE as a host, can we allow TLS 1.2 alone on it?

[Jason Kunst]

Turning off 1.0 and 1.1 forces 1.2 for all communications using TLS