ISE communication flow and ports

[Madura Malwatte]

Hi All,

For someone that is working on ISE for the first time, I'm having some difficulty confirming the communication traffic flow and ports between ise nodes and devices. This is to configure the firewalls in the network. I have ISE nodes sitting in different data centers and between internal and dmz networks, so there are a lot of firewalls in place.

If I refer to the ISE ports reference document and diagram - https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/install_guide/b_ise_InstallationGuide23/b_ise_InstallationGuide23_chapter_0110.html

Some services mention inbound or outbound, but majority of services does not mention which direction. Example for PSN session ports how do I know which direction? Another example in the diagram: traffic flow is from NAD to PSN, so I will need to open the required ports on PSN side, is it correct that the PSN's will never initiate traffic towards the NAD?

Should I go by the diagram and just use the arrows as reference for direction, is this accurate? Or is there a better document?

[howon · Accepted solution]

This is the best resource. Use the arrows and the tables below in the document for details. In regards to the NAD:

- NAD to ISE: RADIUS Authentication & Accounting, T+, SNMP trap, syslog

- ISE to NAD: CoA, SNMP read/write, netflow. Also, if you are using Secure Access Wizard, ISE will initiate SSH to the WLC.

There are additional ports that needs to be open for TrustSec communications show in the document.

[Madura Malwatte]

Hi Hosuk,

Thanks for the reply. Actually 2.3 diagram has NAD to ISE arrows in both directions, so one would assume to open up ports in both directions. But in the 2.2 diagram the arrow is in only one direction (NAD to ISE). These are some of the inconsistencies which are confusing when setting up the firewalls.

Also for multiple PSN's is there any ports needed to open for comms between PSN's?

[howon]

If you have node group configured amongst PSNs, then you need to open TCP/7800 both directions.