Cisco ISE Creating Policy using ERS

[chebbah]

Hi !!

I want to ask if can we create conditions or policy rules using ERS,

if we don't, should I write a script python to do this via postman.

[Charlie Moreton · Accepted solution]

In ISE 3.1 the addition of Open API allows for Policy to be created/deleted/updated via API.

https://developer.cisco.com/docs/identity-services-engine/latest/#!versioning/versioning

[chebbah]

Thank you for your reply, I'm using 2.4.0.357, is it possible with it.

[Charlie Moreton]

@chebbah, no, it is not possible with ISE 2.4.  

Also, note that the version you are using reached Last Date of Support on December 26, 2022, so please consider upgrading to s supported version.

End of Life Announcement for the Cisco Identity Services Engine Software Version 2.4 

[chebbah]

Noted , Thank you

[thomas · Accepted solution]

All ISE APIs are documented @ https://cs.co/ise-api and in the ISE PAN node for ISE 3.1+ via the built-in Swagger UI utility.

CiscoISE on GitHub: https://github.com/CiscoISE

• Python : ciscoisesdk Package | API Docs | Repository
• Ansible : cisco.ise Modules | Documentation | Repository
• Go : isegosdk SDK | Documentation | Repository
• Terraform : Registry | Documentation | Repository

[andriio]

Hi Thomas
it looks like ciscoisesdk runtime constatntly fails for python env >=3.12 with "ModuleNotFoundError: No module named 'imp'"

[thomas]

One of our Security Architects has done it with Ansible & Terraform:

https://github.com/grg1bbs/Ansible_ISE_Policy_Set_MM_LIM

https://github.com/grg1bbs/Terraform_ISE_Policy_Set_MM_LIM

[Greg Gibbs · Accepted solution]

Just be aware that there is currently not full feature parity between the GUI and API. While you can use the API and IaC tools to configure some Policy elements, it is typically just a starting point. The remaining policy elements would need to be configured via the GUI.