ISE ERS - get username and ip address via endpoint MAC

[thwollnik]

Hi all,

when I execute the query https://10.1.2.10:9060/ers/config/endpoint?filter=mac.EQ.00:c0:b7:cd:62:67

I do get the endpoint ID. But how to proceed to get info like IP Address, Username and other info visible in the endpoint browser GUI.

Thanks & Regards

Thomas

[Jason Kunst]

did you check this information?

http://cs.co/ise-api

https://community.cisco.com/t5/security-documents/ise-ers-api-examples/ta-p/3622623

https://community.cisco.com/t5/security-documents/ise-guest-sponsor-api-tips-amp-tricks/ta-p/3636773

[thwollnik]

Yeah Ive read the basic documentation.  The search for an endpoint via a MAC works. But the info that is returned by the API call is not what I need. I need the IP Address and the username for example. Not only of WLAN clients but off all available Endpoints int the identity store. 

[Jason Kunst]

i found this info too

You have to do a call to get a mac address for an endppint, after that you will have the endpoint id
https://community.cisco.com/t5/security-documents/ise-ers-api-examples/ta-p/3622623#toc-hId--721274487
https://community.cisco.com/t5/identity-services-engine-ise/get-endpoint-details-by-ip-address-using-cisco-ers-api/td-p/3740354

[thwollnik]

Hi,

thanks for the info.

I do have the mac address and Im searching for all other details like the IP, hostname, username, etc asscoiated with that MAC. I gave up on  trying to achieve this via the ERS-API.

I exported the endpoint DB to a csv file. Now I can do the queries against this file.

[Jason Kunst · Accepted solution]

I spoke with some co-workers @hslai   said that the ISE APIs are limited. You can provide http://cs.co/ise-feedback

If endpoints have active sessions, then we may get the username and IP address via ISE M&T session API (or pxGrid API)

Otherwise, CSV export from the ISE context visibility UI or ISE admin CLI or using http://iseeat.cisco.com tool. @thwollnik  i see you took this approace

You can get the details using the MAC address. It is a two step process:

1. get the endpoint id
2. use the endpoint id to get the details

It wasn't clear if it showed the ip address or username in the API docs

This is a sample API call response to receive the details for a specific endpoint:

{

  "ERSEndPoint": {

    "id": "a159fd90-e947-11e9-a485-2af7a80ea872",

    "name": "AA:00:22:33:34:56",

    "description": "POS1",

    "mac": "AA:00:22:33:34:56",

    "profileId": "",

    "staticProfileAssignment": false,

    "groupId": "aa0e8b20-8bff-11e6-996c-525400b48521",

    "staticGroupAssignment": false,

    "portalUser": "",

    "identityStore": "",

    "identityStoreId": "",

    "link": {

      "rel": "self",

      "href": "https://10.93.141.40:9060/ers/config/endpoint/a159fd90-e947-11e9-a485-2af7a80ea872",

      "type": "application/xml"

    }

  }

}