ISE 3.x TLS version

[Da ICS16]

Dear Community,

While ISE 3.x versions by default use TLS 1.2, so cannot find an option to enable TLS 1.3.

To avoid the use of weak cipher of TLS 1.2, do you have any recommend /advice to keep it secure like protocols

CBC, RC4,DES...or else?

In case we disabled CBC, RC4, other DES what is occur? Is there impact with ISE and endpoint devices?

Thanks,

[Kasun Bandara]

@Da ICS16 hi, check below guide. HTH

https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_segmentation.html

[JPavonM]

TLS 1.3 is available on ISE 3.3:

[Arne Bier]

Don't get too excited yet about TLS 1.3 support in ISE. For most folks the only advantage of enabling this (it's disabled by default) is that the ISE Admin UI will now negotiate TLS 1.3 with your browser. Yay. But there is no TLS 1.3 for the Guest Portal - I don't remember if I checked the Sponsor Portal - I suspect it's also not running 1.3 yet. 

I have not tested EAP-TLS yet with TLS 1.3 enabled

Just be aware also that if you change these settings in ISE, it will restart ALL of your nodes at the SAME TIME. This means you must plan an outage window in which your entire ISE deployment is offline for 10-15 minutes (or however long it take to restart services in your case) - if you decide to be brave (or stupid) to disable TLS 1.0/1.1 on your ISE deployment that operates 802.1X to clients, then you might be in for a bad day, because of older devices that still work with TLS 1.0 - I was bitten by this with a customer who had older Cisco deskphones that only did TLS 1.0 on EAP-TLS.  The best course of action is to trawl your SIEM (or your entire SYSLOG database) looking for what TLS version was used - if you find 1.0 or 1.1 then find those devices and try to swap them out. Otherwise, don't disable those old protocols.

[MHM Cisco World]

Perfect Answer 

MHM