- Download
- Features
- Base Licensing Features
- IPv6 Phase 3 Support
- REST Support for External Administrators
- Japanese Version of the Administrator Portal
- TrustSec Deployment Verification Report
- CLI Access by External Identity Store
- Support for MUD
- Syslog over ISE Messaging
- PSN Light Session Directory
- Plus Licensing Features
- Apex Licensing Features
- Identify Managed Devices with Dynamic MAC Addresses
- Flexible Remediation Notification
- Generic or Custom Messaging through Cisco AnyConnect
- Upgrades
- Documents
- Videos
- Resources
Download
Existing customers may download the Cisco Identity Services Engine (ISE) 2.6 which was released on February 18, 2019.
For 90-day evaluations of ISE, please see How to Get ISE Evaluation Software & Licenses.
Features
From the New Features section of the ISE 2.6 Release Notes :
|
Feature |
Description |
Business Outcome |
|---|---|---|
Base Licensing Features |
||
IPv6 Phase 3 Support |
ISE ManagementYou can now install and access ISE with either IPv4 or IPv6 addresses. The following ISE functionalities are supported over IPv6:
Network Time Protocol SupportYou can configure and access the NTP server with an IPv4 or an IPv6 address.
The following ISE functionalities are supported over IPv6:
Domain Name System SupportYou can configure a combination of IPv4 and IPv6 Domain Name System (DNS) servers. Failover between all combinations is also possible. For further details, see ISE Cisco Identity Services Engine CLI Reference Guide, Release 2.6. The following ISE functionalities are supported over IPv6:
External RepositoriesYou can now add an external repository with an IPv6 address on ISE. For further details, see Cisco Identity Services Engine Administrator Guide, Release 2.6. Communication between an ISE node and an IPv6 external repository is only possible if the node has an IPv6 address configured to Eth0. Repositories configured with an FQDN will communicate over IPv4 or IPv6 based on:
Audit Logs and ReportsYou can now view logs of login/logout, password change, and operational changes by IPv6 users in the relevant audit reports generated. Simple Network Management ProtocolSimple Network Management Protocol (SNMP) servers can now be contacted via IPv6 addresses.
The following ISE functionalities are supported over IPv6:
Access Control ListsYou can now define Access Control Lists (ACLs) and Airespace ACLs with IPv6 addresses. Dynamic Access Control ListsYou can now define Dynamic Access Control Lists (DACLs) with IPv6 addresses. Active DirectoryYou can now connect to IPv6 deployments of Active Directory from ISE. External Restful Service PortalYou can now specify an IPv6 address or hostname to connect with External Restful Service (ERS). Syslog Client or Logging TargetsYou can connect to IPv6 syslog targets. PostureISE can connect to RADIUS servers with an IPv6 address. |
Allows you to migrate to IPv6-based network for the above mentioned ISE features. |
REST Support for External Administrators |
From Cisco ISE 2.6, External RESTful Services (ERS) users could be either internal user or belong to an external Active Directory. The Active Directory group to which the external user belongs should be mapped to either ERS Admin or ERS Operator group. With this enhancement, administrators no longer need to create an internal user counterpart for external users that need access to ERS services, making this feature easier to use. | Simplified process of enabling external administrators to access RESTful services. |
Japanese Version of the Administrator Portal |
The Administration console currently supports two languages, Japanese and English. You can select either Japanese or English view under Account Settings. | Suitable for Japanese administrators to configure and use Cisco ISE. |
TrustSec Deployment Verification Report |
You can use this report to verify whether the latest TrustSec policies are deployed on all network devices or if there are any discrepancies between the policies configured on Cisco ISE and the network devices. | Can easily verify whether the latest TrustSec policies are deployed on the network devices or if there are any discrepancies. |
CLI Access by External Identity Store |
ISE supports authentication of CLI Administrators by external identity sources, such as Active Directory. | Manage a single source for passwords without the need to manage multiple password policies and administer internal users within ISE, thereby reducing time and effort. |
Support for MUD |
Manufacturer Usage Descriptor (MUD) is an architecture for IoT devices. MUD is tracked by IETF, and the spec is available here: https://datatracker.ietf.org/doc/draft-ietf-opsawg-mud/.
For release 1.0, ISE supports identification of IoT devices, and automatic creation of profiling policies and Endpoint Identity Groups. ISE gets IoT attributes as a MUD-URL in DHCP and LLDP packets, which are delivered by Cisco network devices. ISE does unsigned classification of IoT devices, and accessed through profiler policies. ISE does not store the MUD attributes, the attributes are only used in the current session. In the Endpoints display under Context and Visibility, you can filter IoT devices by the Endpoint profile name. |
The number of IoT devices that are connected to enterprise networks is increasing, and, until now, ISE could not classify those devices. With ISE 2.6, ISE can classify and display the IoT devices that are connected to your network, with an automated process. |
Syslog over ISE Messaging |
Cisco ISE 2.6 offers MnT WAN Survivability for UDP syslog collection. System logs are recorded using ISE Messaging Services. Remote Logging Targets uses the port TCP 8671 and Secure Advanced Message Queuing Protocol (AMQPs) for sending syslog to MnT. By default, the ISE Messaging Service option is disabled. |
Operational data will be retained for a finite duration even when MnT node is unreachable. |
PSN Light Session Directory |
The Light Session Directory can be used to store user session information and replicate it across the Policy Service Nodes (PSNs) in a deployment, thereby eliminating the need to be totally dependent on Primary Administration Node (PAN) or Monitoring and Troubleshooting (MnT) nodes for user session details. The Light Session Directory stores only the session attributes required for Change of Authorization (CoA). To enable the Light Session Directory feature, choose Administration > Settings > Light Session Directory and select the Enable Light Session Directory check box. | Improved performance and scalability. |
Plus Licensing Features |
||
Apex Licensing Features |
||
Identify Managed Devices with Dynamic MAC Addresses |
AnyConnect 4.7 now provides a Unique Device ID (UDID) to identify a connected user. The UDID value can be mapped with information from Mobile Device Management (MDM) providers to help identify users who have the same MAC address. MAC address sharing is common in open offices, where more than one person shares a dock or USB dongle. |
You can develop a solution that uses the UDID to uniquely identify a user, when device connections are shared. |
Flexible Remediation Notification |
Go to Policy > Posture > Delay Notification to delay the grace period prompt from being displayed to the user until a specific percentage of grace period has elapsed. For example, if the Delay Notification field is set to 50 percent and the configured grace period is 10 minutes, Cisco ISE checks the posture status after 5 minutes and displays the grace period notification if the endpoint is found to be noncompliant. Grace period notification is not displayed if the endpoint status is compliant. If the notification delay period is set to 0 percent, the user is prompted immediately at the beginning of the grace period to remediate the problem. However, the endpoint is granted access until the grace period expires. | Flexible Grace Period Remediation prompts start for endpoints. Prevents unnecessary remediation prompts for endpoints waiting for JAMF or Microsoft System Center Configuration Manager (SCCM) updates. |
Generic or Custom Messaging through Cisco AnyConnect |
More informative messages can now be displayed by Cisco AnyConnect, when it is used for ISE Posture. End users can now see messages about posture status and errors. You can also modify the content that is displayed in AnyConnect posture profiles. Note that this requires Cisco AnyConnect Version 4.7. | Better communication with the end user. |
Upgrades
You can directly upgrade to Release 2.6 from the following Cisco ISE releases:
- 2.1
- 2.2
- 2.3
- 2.4
If you are on a version earlier than Cisco ISE, Release 2.1, you must first upgrade to one of the releases listed above and then upgrade to Release 2.6.
Documents
- Release Notes for Cisco Identity Services Engine, Release 2.6
- Cisco Identity Services Engine Administrator Guide, Release 2.6
- Cisco Identity Services Engine Network Component Compatibility, Release 2.6
- Cisco Identity Services Engine Installation Guide, Release 2.6
- Cisco Identity Services Engine Upgrade Guide, Release 2.6
- Cisco Identity Services Engine CLI Reference Guide, Release 2.6
- User Guide for Cisco Secure ACS to Cisco ISE Migration Tool, Release 2.6
- Certificate Provisioning Portal FAQs, Release 2.6
- Sponsor Portal User Guide for Cisco Identity Services Engine, Release 2.6
- Cisco Secure Network Server Data Sheet
- Cisco Identity Services Engine Ordering Guide
- Cisco Identity Services Engine Evaluation License Agreement
Videos
See our CiscoISE YouTube Channel for our latest videos!
Resources
- ISE Resources: http://cs.co/ise-resources
- Public Community: http://cs.co/ise-community
- ISE PIC Community: http://cs.co/ise-pic
- How to Get ISE Evaluation Software & Licenses
- ISE Training: http://cs.co/ise-training
- ISE YouTube Channel: http://cs.co/ise-videos
- ISE Compatibility Guides: http://cs.co/ise-compatibility
- TrustSec Compatibility: http://cs.co/trustsec-compatibility
- TrustSec Resources: http://cs.co/trustsec-resources
- ISE Design & Integration Guides: http://cs.co/ise-guides
- ISE Licensing / Ordering Guide: http://cs.co/ise-licensing
- ISE Portal Builder: http://isepb.cisco.com
- ACS to ISE Migration: http://cs.co/acstoise
For Cisco Partners and Sales Engineers
- Selling ISE: http://cs.co/selling-ise
- ISE Instant Demo: http://cs.co/ise-instant-demo
- ISE Demos & PoVs: http://cs.co/selling-ise-demos
- ISE Sales Training: http://cs.co/selling-ise-training
