Query Regarding Endpoint Visibility via Cisco ISE

[snbw16]

Certainly! Here's a rephrased version of your message in a more formal and concise tone:

---

Subject: Query Regarding Endpoint Visibility via Cisco ISE

Hello All,

In our environment, CLI access for network devices (switches, routers, etc.) is authenticated using TACACS+ through Cisco ISE. I would like to understand whether Cisco ISE can provide visibility into the number of endpoints currently connected to the switches.

RADIUS authentication for endpoints is handled by a separate solution. Kindly advise on this.

[Torbjørn]

This should be possible by sending radius accounting to ISE, though I must admit that I have never tried this myself and can't find any examples of this on the web. Please report back if you do try this though!

[wajidhassan]

Hi @snbw16 ,

Cisco ISE primarily handles authentication and authorization (TACACS+ for device admin access, RADIUS for endpoint access) but does not directly provide detailed visibility on the number of endpoints connected to switches.

For endpoint visibility, you typically need to integrate ISE with network devices and use features like SNMP polling, NetFlow, or Cisco DNA Center, which can collect endpoint information from switches.

So, while ISE controls access, detailed endpoint counts and visibility usually come from complementary network management or monitoring tools.

Hope this helps!

[Arne Bier]

That questions sounds like a reply from a chatbot. But regardless, you can use a standalone ISE to poll switches to extract the endpoints (MAC addresses). This would require you telling ISE what all you switches are, and enabled SNMP on them to allow ISE to run a scan against. It's an audit option for customers to get an insight into a point-in-time endpoint status. 

[MHM Cisco World]

Did you check report ?

Operations → Reports → TACACS Authentication/Authorization

MHM