cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3973
Views
1
Helpful
13
Replies

ISE REST API - how to apply an ANC policy

Cristian Ruta
Level 1
Level 1

Hello community,

I am testing out ISE 2.1 REST API.

I managed to create a new ANC policy and want to apply it to an endpoint.

When I PUT https://IP:9060/ers/config/ancendpoint/apply

I receive 400 bad request:

        <message type="ERROR" code="Application resource validation exception">

            <title>No additional attribute has been defined</title>

Do you have an example of how to deploy a quarantine ANC policy for a specific IP via REST?

Thank you,

Cristian

PS: I want to do this without pxgrid.

1 Accepted Solution

Accepted Solutions

Hey Cristian,

Just to close the loop on this thread, i emailed you a screenshot using POSTMAN of assigning the endpoint to an ANC policy.  If you have additiona questions, email me directly.

Thanks,

John

jeppich@cisco.com

View solution in original post

13 Replies 13

Charlie Moreton
Cisco Employee
Cisco Employee

Cristian,

I was able to find this, albeit from ISE 1.3, but I have not been able to find anything newer.

REST.PNG

According to the chart, what you are looking to do is only available through pxGrid.

If there are any updates to this chart, I hope it is posted.

It's at the bottom of this document:

ISE Version 1.3 pxGrid Integration with IPS pxLog Application - Cisco

Charles Moreton

Hello Charles,

Thank you for your time on this.

As per ISE2.1 API documentation[1], operations like applying a policy to a mac address are developed. Also the /ers/sdk page on ISE2.1 documents apply operation, but without details. I cannot figure it out how a successful PUT looks in this case, i am not sure what OperationAdditionalData means.

OperationHTTP MethodURL

Get all

GET

https://<hostname>:9060/ers/config/ancendpoint

Get by ID

GET

https://<hostname>:9060/ers/config/ancendpoint/{id}

Get by MAC

PUT

https://<hostname>:9060/ers/config/ancendpoint

with OperationAdditionalData MACAddress

Get by IP

PUT

https://<hostname>:9060/ers/config/ancendpoint

with OperationAdditionalData IPAddress

Apply by MAC

PUT

https://<hostname>:9060/ers/config/ancendpoint

with OperationAdditionalData MACAddress and PolicyName

Clear by MAC

PUT

https://<hostname>:9060/ers/config/ancendpoint

with OperationAdditionalData MACAddress and PolicyName

Apply by IP

PUT

https://<hostname>:9060/ers/config/ancendpoint

with OperationAdditionalData IPAddress and PolicyName

Clear by IP

PUT

https://<hostname>:9060/ers/config/ancendpoint

with OperationAdditionalData IPAddress and PolicyName

Is there any chance to find the answer for this?

tha

[1]Cisco Identity Services Engine API Reference Guide, Release 2.1 - External RESTful Services Calls [Cisco Identity Servic…

jeppich
Cisco Employee
Cisco Employee

Hey Christian,

Are you using POSTMAN for issuing the REST API requests?  You need to fill in the HTTP "Accept" header and HTTP "Content-Type" header information. You can see the values in ISE via https://{ip adderess:9060/ers/sdk.

Thanks,

John

jeppich@cisco.com

Hello John,

I am so happy for the prompt answers, thank you!

Yes I  am also using Postman for this and I send the Content-type and Accept header as specified in sdk page.

Screen Shot 2016-09-02 at 22.11.45.png

I am not sure how the body should be:

Screen Shot 2016-09-02 at 22.12.30.png

I have successfully POSTed ancpolicies. results are appearing in real time on ISE, but with ancendpoints POST method is not implemented, and i am a little bit confused of how can i update(PUT) an ancendpoint if no ancendpoint exists.

Thanks for your involvement,

Cristian

ruta.cristian@gmail.com

jeppich
Cisco Employee
Cisco Employee

Hey Christian,

You would either have to create an endpoint or use an existing endpoint. Let me work up some examples and email them out to you.

Thanks,

John

jeppich@cisco.com

Hello John,

Thank you very much!

Have you had the time to test it out?

Best regards,

Cristian

Hey Christian,

I  will get this done today and email this out to you.

Thanks,

John

jeppich@cisco.com

Thank you John,

Any news?

Sorry for keep asking,

Cristian

imbashir
Cisco Employee
Cisco Employee

Hello imbashir,

Have you tried this with postman ?

Thanks,

Cristian

Hey Cristian,

I will work on this today and directly email you the procedure using POSTMAN.

Thanks

John

jeppich@cisco.com

Hey Cristian,

Just to close the loop on this thread, i emailed you a screenshot using POSTMAN of assigning the endpoint to an ANC policy.  If you have additiona questions, email me directly.

Thanks,

John

jeppich@cisco.com

Cristian Ruta
Level 1
Level 1

problem solved, thanks John

Screen Shot 2016-11-10 at 20.50.05.png

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: