cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Ask the Expert- SD-WAN

How To: Integrate Firepower Management Center (FMC) 6.0 with ISE and TrustSec through pxGrid

19341
Views
12
Helpful
4
Comments

February 2016

This document is intended for Cisco engineers and customers who are interested in deploying Cisco Firepower Management Center (FMC) 6.0 with Cisco Identity Service Engine (ISE 1.3 or higher) using (platform exchange Grid) pxGrid.

Please note that pxGrid remediation is not supported in Cisco Firepower Management Center FMC 6.0.

Cisco Firepower Management Center (FMC) 6.0 can now enforce an organizations security policy based on ISE session attribute information available through pxGrid. These security policies can be applied to and enforced by the Cisco Firepower to managed NGIPS sensors and/or an ASA with Firepower services. The ASA with Firepower services vsm also manage these policies locally via ASDM.

This document provides the details of configuring Cisco Firepower Management Center (FMC) 6.0 and pxGrid integration with ISE in an ISE Stand-Alone environment using self-signed certificates or using CA (Certificate Authority)- signed certificates.

In this document an ASA with Firepower services will be configured with the ASA Firepower (sfr) module and register with Cisco Firepower Management Center (FMC) 6.0 to use the centrally managed Cisco Firepower Management Center policy. The ASA with Firepower services will also be configured on-box with the Firepower intrusion policy and access control rule independent of the FMC.

The Cisco Firepower Management Center managed security policy and ASA on box Firepower Management policy will consist of an intrusion policy and Employee SGT access control rule for denying access to specific web categories.

Comments

Hi Thomas!

This integration uses pxGrid, so a Plus License is required, but how many licenses I would need and how these will be consumed?


I'll appreciate your help.

Kind regards.

Cisco Employee

http://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0101.html#concept_F7FC0B895D284727B8E3DDDBCAD1A23A

pxGrid is used to share context collected by ISE with other products. A Plus license is required to enable pxGrid functionality. There is no session count decrement when context for session is shared. However, to use pxGrid, the number of Plus sessions licensed must be equal to the number of Base sessions licensed. For more information, see Cisco ISE Licenses and Services section in Cisco Identity Services Engine Ordering Guide<http://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf>.

http://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.pdf

Thank you Jason.

Just to add, the ordering guide also says "Service is enabled with a valid Plus license. Requires a 1:1 Plus to Base license sessions".

My customer won't like this .

Regards!

Beginner

Great Very helpful information.

I just have an Cisco FMCv version 6.2.2 and FTDv version 6.2.2, I configured both the machines and FTD registered in FMC. I have a IPS policy but its Security Intelligence feed are not coming in it.

DO you know whats wrong about the miss configuration of FMC policies.

Resolution of IT:

We need to open port 443 from FMC to talk with Talos to get feeds from it. Further more we can also manually get the blacklist ips and stored it to SI policies, Am i correct?
Thanks