Cisco ISE 2.6 security settings

[jm.virtual01]

I ma using Cisco ISE 2.6. I have enabled TLS 1.0 and TLS 1.1 in current deployment. Now i need to disable TLS 1.0

I wanted to know that in my network is there any end device that using TLS 1.0, how can find that?

Is there and recommendations for security setting for ISE 2.6?

[Greg Gibbs · Accepted solution]

See a similar post here for potential impacts to disabling ciphers in ISE.

The TLS version used by EAP for a particular connected client can be found in the endpoint Attribute details in Context Visibility.

Example:

This information is not included in the CSV export from Context Visibility or the API, however, so you would need to pick a subset of endpoints that represents your fleet and check them individually.

If you still have Win7 PCs, you should also be aware of the registry settings required to enable TLS 1.2 as per the following document:

EAP-TLS 1.2 and Windows Clients

Best Practice would be to disable any insecure ciphers that are not in use but, as with anything, you need to find the right balance between Security and Usability.

[russell.sage]

Hi do you know if disabling security settings requires any sort of reboot or restart of the ISE services.

[Marcelo Morais]

Hi @russell.sage ,

 no, only Save (please take a look at: Configure Security Settings)

Hope this helps !!!

[Damien Miller]

It might not be applicable to you, but another thing to keep in mind is that the standard TrustSec provisioning process requires TLS 1.0, and if you disable TLS 1.0 on the deployment, that will stop working. 

IOS-XE 17.3 introduced a HTTPS API based TrustSec provisioning method that allows for you to disable TLS 1.0, but it would require all network devices to be running this new code, and all of them to be reconfigured to leverage this method. 

[russell.sage]

Hi

Many thanks for that piece of information. We don't currently use TrustSec.