Pushing Configuration Changes with ISE

[latenaite2011]

Is there a way to push configuration changes to ISE like what Cisco Works is able to do 

[Damien Miller · Accepted solution]

Yes, but in an extremely limited way. Not at all like Prime, APIC-EM, DNA, or Works. You can have port vlans and dacls pushed during a user authentication flow for example.

You cannot configure things that I would normally considered infrastructure commands, radius servers, qos, stp, routing, static acls, etc. Basically anything outside of the realm of authenticating and securing a user. ISE is the policy server, not a replacement for the others listed above. I do however wish ISE could audit NAD config in a useful way.

[latenaite2011]

Thank you Damien for your quick response.

How about finding unused ports and shutting those down?

[Damien Miller]

No, that's not possible from ISE. I think the closest you could get is a port config status report from Context Visibility > Network Devices > Port Config Status > Run on All/Selected. This uses SNMP to poll the switch but only provides back minimal port related config but no way to act on it.

When I think about unused ports and the security risk they present to an enterprise, I think ISE can be leveraged in a more efficient way than shutting down ports. Eventually the goal is to get your switches to a closed mode state, where if an endpoint plugs in and is not allowed to be on the network, then you have restricted them via the access policy. You can couple this with TrustSec to further secure known endpoints with scalable group tags, and limit host to host communication at your preference based on their authentication results. Might not work for all environments but is a nice approach.