Showing results for 
Search instead for 
Did you mean: 

What's New in ISE 2.3?


The need for robust access control that scales has never been greater. Rich visibility into who and what are on your network along with the ability to segment end-to-end using a software-defined approach are critical requirements of customers who are seeing an explosion of connected devices as well as a perpetual deluge of network breaches across every industry. Which is why the latest version of Cisco ISE doubles-down on outcomes that realize a secure digital network. It does this through enabling automation, administrative simplification, and net new capabilities.

ISE 2.3 offers DNA Center integration, new policy UI, enhanced posture, guest network login using Facebook credentials, read-only access, many ACS parity features, an Upgrade Readiness Tool and more! For additional details, see the ISE 2.3 Release Notes.

Enabling the Cisco Software-Defined Access architecture

Now you can manage and automate your network - including policy and access - from a single dashboard with Cisco DNA Center. DNA Center is a holistic, end-to-end network management platform for the Network. Intuitive. Integrating ISE allows the DNA Center to define and enact policy to control access across the network, all from a unified interface. Cisco ISE 2.3 is a required integration component for the DNA Center, along with APIC-EM and the Network Data Platform, which all make up the Software-Defined Access solution

Simpler policy creation and management

It is now easier to create and manage policies with the new policy interface. These simplified policy sets are more readable and include all of the authentication and authorization rules, and allow you to easily create and reuse conditions. After upgrading your policies will work as before, though additional policy sets have been created. See the video below for more information. The new policy UI now includes a hit counter for each policy set.

Enhanced posture

ISE with AnyConnect now provides additional endpoint visibility, including BIOS-level details such as the computer’s serial number, USB attachments, and resource utilization, including disk and memory usage. ISE is now able to perform posture assessment on Windows and Mac OS endpoints without a persistent agent. This new approach replaces the existing web agent and makes use of a temporal agent, which has similar posture checks as the full AnyConnect secure mobility client but without required endpoint administrative privileges or reliance on browser plugins. Cisco continues to offer a wide range of posture agents to assist with different deployments. This includes the option for a stealth agent to display flexible notifications via OS messaging frameworks.

Social login for guest services

Guests will have the choice to log into the network using their Facebook credentials. This can be an option in addition to creating a local ISE account. Social login for guests provides seamless a guest experience that's an easy and fast way to allow guest access to the network.

Read-only admin support

Read-only access allows network administrators to grant others access to review existing configurations, generate reports, and plan accordingly, without the right to make changes.

Final phase of ACS parity

ISE 2.3 includes the final suite of capabilities designed to reach feature parity with Cisco Secure Access Control System (ACS), allowing all existing ACS customers to migrate their deployment to ISE. New features include TACACS+-based device administration for IPv6, import and export capabilities for TACACS+-based command sets, policy export scheduling, IP range support in all octets, and more. See the ACS vs ISE Comparison for feature comparisons with every release of ISE.

Upgrade Readiness Tool (URT)

The Upgrade Readiness Tool (URT) should be run prior to an ISE software upgrade in order to detect and fix any data upgrade issues. Most of the upgrade failures occur because of data upgrade issues and the URT is designed to validate the data before the actual upgrade. The URT will report and try to fix the issues, wherever possible. The URT is a separate download in the Cisco Software Center.

Additional Resources

ISE 2.3 What's New [Powerpoint]

ISE 2.3 Release


how do we upgrade?

Cisco Employee


Download the upgrade bundle for your deployment then follow the upgrade guide on CCO.




Thank you... upgrade bundle didn't appear at first.. any instructions on how to run URT? thanks

Cisco Employee

URT instructions and sample results are  part of 2.3 Upgrade guide.


I've recently upgraded from 2.2 to 2.3 and can see first hand the issues that are introduced with the new version. For instance, right after the upgrade the Guest Portal lost its customization configs. Also, the changes to the policy tab makes it difficult to define AuthC and AuthZ policies vs 2.2 which was straightforward. Is it possible to bring back the old look of 2.2 policy tab?

Cisco Employee

No, there is not an option to bring back the old ISE policy view. I'm sure you've already looked at the video of the new policy interface above to understand the changes and reasons for why we did this. The Authentication and Authorization capabilities have not changed, just the way you view them.


I think you might find 2.3 to be very convenient and friendly once you get used to it. I know it can be hard to make such changes. But the AuthC and AuthZ are now together in the same place, for example, which really might even make it easier for you to track your policies.


I still miss the old policy set look and feel. At least in my onion it was a lot easier to navigate and create policies.


The link to the powerpoint presentation does not work. I am getting access denied and additional authorization is need. Can you please fix that?

Thank you


Cisco Employee

Please register as a partner to get access to the powerpoint. Check the help topic -- Getting Access