Cisco ISE Creating Policy using ERS

[chebbah]

Hi !!

I want to ask if can we create conditions or policy rules using ERS,

if we don't, should I write a script python to do this via postman.

[Charlie Moreton · Accepted solution]

In ISE 3.1 the addition of Open API allows for Policy to be created/deleted/updated via API.

https://developer.cisco.com/docs/identity-services-engine/latest/#!versioning/versioning

[chebbah]

Thank you for your reply, I'm using 2.4.0.357, is it possible with it.

[Charlie Moreton]

@chebbah, no, it is not possible with ISE 2.4.  

Also, note that the version you are using reached Last Date of Support on December 26, 2022, so please consider upgrading to s supported version.

End of Life Announcement for the Cisco Identity Services Engine Software Version 2.4 

[chebbah]

Noted , Thank you

[thomas · Accepted solution]

All ISE APIs are documented @ https://cs.co/ise-api and in the ISE PAN node for ISE 3.1+ via the built-in Swagger UI utility.

CiscoISE on GitHub: https://github.com/CiscoISE

• Python : ciscoisesdk Package | API Docs | Repository
• Ansible : cisco.ise Modules | Documentation | Repository
• Go : isegosdk SDK | Documentation | Repository
• Terraform : Registry | Documentation | Repository

[andriio]

Hi Thomas
it looks like ciscoisesdk runtime constatntly fails for python env >=3.12 with "ModuleNotFoundError: No module named 'imp'"

[thomas]

One of our Security Architects has done it with Ansible & Terraform:

https://github.com/grg1bbs/Ansible_ISE_Policy_Set_MM_LIM

https://github.com/grg1bbs/Terraform_ISE_Policy_Set_MM_LIM

[Greg Gibbs · Accepted solution]

Just be aware that there is currently not full feature parity between the GUI and API. While you can use the API and IaC tools to configure some Policy elements, it is typically just a starting point. The remaining policy elements would need to be configured via the GUI.

[euahmed]

Hi Greg , 

Please can you share you inputs to how to create Network Device policy set using POST REST API call in postman and do the custom modification  in the body .

I have taken this below request from swagger-ui and trying to do some modification using POSTMAN POST API call . But I am  not able to create policy using POSTMAN and getting below Error .

Do you suggest me how  to get resource-id in POST API call for new policy set creation,

Request API call for creating new policy set in ISE :

{
"condition": {
"conditionType": "ConditionAttributes",
"isNegate": false,
"link": {
"href": "https://{{ISE_IP}}/api/v1/policy/{{protocol}}/policy-set/{{resource-id}}",
"rel": "self",
"type": "application/json"
}
},
"description": "My Description",
"isProxy": false,
"link": {
"href": "https://{{ISE_IP}}/api/v1/policy/{{protocol}}/policy-set/{{resource-id}}",
"rel": "self",
"type": "application/json"
},
"name": "My_policy_set 1"-Customized policy set",
"rank": 0,
"serviceName": "Default Network Access",
"state": "enabled"
}

Getting Error for above request : 

{
"message": "condition.operator, may not be null, condition.dictionaryName, may not be null, condition.attributeValue, may not be null, condition.attributeName, may not be null",
"code": 400
}

with regards 

Erfan