ISE integration with cisco DNA

[Amr Ali Mohamed]

Dears,

I need to understand which certificates are used between ISE and DNA, and if I do not have an internal CA how I can use the signed certificate and the DNA 

[balaji.bandi · Accepted solution]

ISE and DNAC are integrated is via ERS and pxGrid command practice, if you do not have PKI environment, ISE can act as CA

below document ISE and DNAC integration.

https://community.cisco.com/t5/networking-knowledge-base/how-to-cisco-dna-center-ise-integration/ta-p/3896410

ISE can be as CA :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-30/217161-ca-service-and-est-service-on-ise.html

[Arne Bier]

@Amr Ali Mohamed - When reading up on DNAC and certificates, remember that in DNAC, there is the certificate that is used by the DNAC web UI (web server) and then there is the concept of the DNAC CA, which is DNAC's internal CA that issues certificates to the devices that you add into the Inventory. The DNAC/ISE integration is quite easy these days, because DNAC will do all the hard work for you, via REST API calls to ISE. There are also differences in how many years a cert is valid, based on what version of DNAC you are using, and even, what version you started on and upgraded to. It's one thing getting a cert installed, but then you have to keep an eye on the End Date of those certs, and whether or not you are responsible for updating them, or whether it's automatic.  I have a personal preference for making these internal system certs (ISE/DNAC, DNAC/Devices) last as long as the software will allow you, to avoid this hassle of manual updates. It's common for public facing certs to be valid for 90 days or 365 days, but for internal facing systems like Cisco products, IMHO, this causes more problems than it's worth.