It gives me great pleasure to announce the availability of Cisco Identity Services Engine (ISE) 2.6. This release is all about solving more for customers – better features and scale to deal with the Enterprise IoT era, better security and better ability to understand how your network access services and policy are deployed. Among other capabilities, being part of the Cisco DNA offer, ISE 2.6 is yet another big stride towards a better Software Defined Access.
What’s new in ISE 2.6:
Two million concurrent authentications- Our customers deal with the proliferation of IoT devices in their Enterprise networks– and with ISE 2.6, ISE allows them to understand what’s on the network and securely connect all of these devices – up to 2 million of these endpoints in a single ISE deployment, or “ISE cube” as we fondly call it
Faster, more powerful, fault-tolerant appliances- Managing and controlling all your user and device sessions requires some serious processing power. That’s why ISE 2.6 introduces new Cisco Secure Network Server (SNS) 36xx-Series appliances. These all-new, high-performance models are ideal for the largest deployments. While the 3615 is the 3515’s replacement and provides the same horsepower and concurrent endpoint count, the SNS-3655 handles medium-sized deployments (up to 50,000 concurrent sessions in a single PSN) and replaces the 3595. The new SNS-3695 is fully packed with 256GB memory, to be able to both act as a Policy Administration Node (PAN) and/or Monitoring and Troubleshooting Node (MnT) and can at the same time handle large-sized deployments (up to 100,000 concurrent sessions)
New ISE management support on IPv6 networks- More and more organizations are adopting IPv6 to uniquely address the massive number of new devices on their networks. With ISE 2.6, you can now manage ISE itself on a native IPv6 network, including connecting to the ISE management interface (both web and command-line) and to Active Directory and other management protocols
Identify managed devices with dynamic MAC address- Open seating environments with shared docking stations and ethernet dongles pose a challenge as the same MAC address is now linked to many different users and devices each day. That’s why ISE 2.6 with AnyConnect 4.7 now uses a Unique Device Identifier in order to uniquely identify the device, no matter what MAC address it uses
More flexible grace periods and custom user notifications- While customers try to ensure that all connected endpoints are compliant, there are situations where organizations would allow endpoints to connect while they improve their posture to meet corporate compliance requirements. ISE 2.6 and AnyConnect 4.7 now offers extended grace periods to allow users to connect and update their systems while presenting a customizable message to the end explaining their compliance status
TrustSec deployment reports. ISE 2.6 reports show the propagation of TrustSec deployment after a change was made in the TrustSec matrix, and allows administrators to verify that all their TrustSec enabled network devices are up-to-date with the latest policy
Active Directory Authentication for CLI & REST API calls- AD authentication is now available for both our REST APIs and command-line product administration
MUD Support.Manufacturer Usage Descriptor (MUD) is an architecture for IoT devices. Based on information derived from MUD, ISE 2.6 supports increased identification of IoT devices, and automatic creation of profiling policies and Endpoint Identity Groups
Quality Improvements– as part of our ongoing quality improvement process, ISE 2.6 includes a host of quality improvements – from customer-found defects, thru rewriting areas of code that were found to be too squeaky to improving the architecture and infrastructure of the product – all of them reinforce our commitment to providing the best in class product while ensuring best quality, resiliency and stability
Where is ISE 2.5?
As we are announcing a new generation of appliances (SNS-36XX) together with ISE 2.6, we wanted to ensure that the ISE release that goes with it is a Long Term Release (LTR) as described in “Cisco Identity Services Engine Software Release Lifecycle”. As our LTR releases are typically even-numbered, we decided to just renumber the ISE 2.5 release to be called ISE 2.6. There is no difference in the release’s content – what was supposed to be part of ISE 2.5 is still there, just called ISE 2.6.
EOL Announcement for legacy ISE PIDs
With the release of ISE 2.6, the Mobility Upgrade PIDs, ISE Advanced PIDs, ISE Express PIDs, Legacy Plus and Apex PIDs, Legacy Base and Device Admin PIDs and Legacy Virtual Machine PIDs all reach their actual End of Sales milestone. The End of Sales announcement for these PIDs can be foundhere. Furthermore, do notice End of Sales that was announced for ISE releases 2.0, 2.0.1, 2.1 and 2.3, available atthe same location.
Our FMC and FTDs are running 6.6.4. We have some rules that fit better into the prefilter policy, so it it possible to take a rule that is in the standard ACP and move it into the prefilter policy, or will it have to be recreated? Thanks
Hello Team, i have collected DART file from Cisco Anyconnect VPN (customer side) in order to understand the root cause of issue.. issue user are getting no policy server detected while trying to connect to VPN via Cisco ISE 2.4.0 for postur...
Hello, I am looking for a way to automate all needed config for DKIM signing and also for key rotations.this might not be an issue for deployments with just a few domains, but as soon as you get to 100+ domains it is quite an effort. I am curren...
Hi Experts,Just wanted to know what information is backed up in the operations data on ISE?Can this be used to extract reports for more than 90 days...?Report including posture by endpoint or posture by posture policy?
Hi Experts,Is it possible to create a site-to-site VPN with dual ISP on one ASA, for backup/redundancy purposes? we have a branch with two internet links from two different ISP terminates on one ASA. I would like to set up a site-to-site VPN to conn...