cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
543
Views
1
Helpful
1
Replies

What are the advantages of using pxGrid in ISE?

What are the advantages of using pxGrid in ISE?
I've read several pxGrid integration guides.
But I don't understand the use case exactly.
For example,
When using FMC and ISE without integrating
When integrating with FMC
What makes a difference??

1 Accepted Solution

Accepted Solutions

@JustTakeTheFirstStep pxGrid is a secure communication protocol, when configured ISE will share context information (User/IP binding, SGTs (Security Group Tag), SGT/IP bindings, endpoint profile information, threat data etc) with the FMC and other subscribed systems such as Stealthwatch, DNAC, WSA and other 3rd party solutions.

In regard to ISE/FMC integration, with this information learnt from pxgrid on the FMC, you will now have a username associated to the IP address. You can then create rules based on username or AD group (with AD realm) instead of just the IP address and also provide more useful information when looking at the firewall logs. You will also have the ability for the FMC to instruct ISE to quarantine the user/endpoint at source (the connected switchport) based on a firewall event (malicious activity).

https://www.ciscopress.com/articles/article.asp?p=2963461

 

View solution in original post

1 Reply 1

@JustTakeTheFirstStep pxGrid is a secure communication protocol, when configured ISE will share context information (User/IP binding, SGTs (Security Group Tag), SGT/IP bindings, endpoint profile information, threat data etc) with the FMC and other subscribed systems such as Stealthwatch, DNAC, WSA and other 3rd party solutions.

In regard to ISE/FMC integration, with this information learnt from pxgrid on the FMC, you will now have a username associated to the IP address. You can then create rules based on username or AD group (with AD realm) instead of just the IP address and also provide more useful information when looking at the firewall logs. You will also have the ability for the FMC to instruct ISE to quarantine the user/endpoint at source (the connected switchport) based on a firewall event (malicious activity).

https://www.ciscopress.com/articles/article.asp?p=2963461