Enabling the Cisco Software-Defined Access architecture
Now you can manage and automate your network - including policy and access - from a single dashboard with Cisco DNA Center. DNA Center is a holistic, end-to-end network management platform for the Network. Intuitive. Integrating ISE allows the DNA Center to define and enact policy to control access across the network, all from a unified interface. Cisco ISE 2.3 is a required integration component for the DNA Center, along with APIC-EM and the Network Data Platform, which all make up the Software-Defined Access solution.
The need for robust access control that scales has never been greater. Rich visibility into who and what are on your network along with the ability to segment end-to-end using a software-defined approach are critical requirements of customers who are seeing an explosion of connected devices as well as a perpetual deluge of network breaches across every industry. Which is why the latest version of Cisco ISE doubles-down on outcomes that realize a secure digital network. It does this through enabling automation, administrative simplification, and net new capabilities.
ISE 2.3 offers DNA Center integration, new policy UI, enhanced posture, guest network login using Facebook credentials, read-only access, many ACS parity features, an Upgrade Readiness Tool and more! For additional details, see the ISE 2.3 Release Notes.
Guest Enhancements Guests will have the choice to log into the network using their Facebook credentials. This can be an option in addition to creating a local ISE account. Social login for guests provides seamless a guest experience that's an easy and fast way to allow guest access to the network.
Migration Tool EnhancementsISE 2.3 includes the final suite of capabilities designed to reach feature parity with Cisco Secure Access Control System (ACS), allowing all existing ACS customers to migrate their deployment to ISE. New features include TACACS+-based device administration for IPv6, import and export capabilities for TACACS+-based command sets, policy export scheduling, IP range support in all octets, and more. See the ACS vs ISE Comparison for feature comparisons with every release of ISE.
Policy Sets It is now easier to create and manage policies with the new policy interface. These simplified policy sets are more readable and include all of the authentication and authorization rules, and allow you to easily create and reuse conditions. After upgrading your policies will work as before, though additional policy sets have been created. See the video below for more information. The new policy UI now includes a hit counter for each policy set.
Posture Enhancements ISE with AnyConnect now provides additional endpoint visibility, including BIOS-level details such as the computer’s serial number, USB attachments, and resource utilization, including disk and memory usage. ISE is now able to perform posture assessment on Windows and Mac OS endpoints without a persistent agent. This new approach replaces the existing web agent and makes use of a temporal agent, which has similar posture checks as the full AnyConnect secure mobility client but without required endpoint administrative privileges or reliance on browser plugins. Cisco continues to offer a wide range of posture agents to assist with different deployments. This includes the option for a stealth agent to display flexible notifications via OS messaging frameworks.
Read-only Administrator SupportRead-only access allows network administrators to grant others access to review existing configurations, generate reports, and plan accordingly, without the right to make changes.
Upgrade EnhancementsThe Upgrade Readiness Tool (URT) should be run prior to an ISE software upgrade in order to detect and fix any data upgrade issues. Most of the upgrade failures occur because of data upgrade issues and the URT is designed to validate the data before the actual upgrade. The URT will report and try to fix the issues, wherever possible. The URT is a separate download in the Cisco Software Center.
routingHello,For some reason I am not able to each peer's IP, though port channel and their subs are up. Arista [eth5]====[gi4]Cisco CSR ping 10.248.100.5Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.248.100.5, timeout is 2 ...
I have an issue where I am trying to connect a Win10 machine using AnyConnect with Posture module and I am getting a certificate error stating it doesn't trust the cert assigned to my ISE admin node. The client provisioning portal loads (https://fqdn:8443...
unable to connect I am getting the following debug information? SA KE N NOTIFY(IKEV2_FRAGMENTATION_SUPPORTED) NOTIFY(NAT_DETECTION_SOURCE_IP) NOTIFY(NAT_DETECTION_DESTINATION_IP) VID VID VID VID*May 14 15:17:05.067: IKEv2:(SESSION ID...
I've got ISE-PIC setup for testing. I am seeing active sessions logged after setting a group policy to enable "Audit Kerberos Authentication Service" and "Audit Kerberos Service Ticket Operations" My problem is this only shows users ...
Hi ExpertsWe've ISE 2.6 running and the client is using an Mcafee AV solution and now would like to replace it with the Windows Defender (WD). I've been asked not to change the posture policy to 'Audit' or 'Optional' mode, to enforce the corporate policie...