on
09-30-2022
04:06 AM
- edited on
11-21-2022
06:30 AM
by
Mariley Reinoso Olivera
Cisco Identity Services Engine v3.x offers major usability benefits across many of its use cases. With better speed and agility, you are able to achieve security resilience with a fully mature zero trust solution while gaining pervasive visibility and dynamic control.
I am Viraj Nagarmunoli, Solutions Architect with Customer Success and together with Security Customer Success Specialist @Yash Kejariwal, I put together the table below summarising some of the key features of ISE 3.x
Feel free to ask us any questions about Cisco ISE upgrades using the button below the post.
Start planning your upgrade here.
If you want to stay up to date with our Software Compliance and key feature articles make sure to subscribe to the label 'Software Upgrades'
Capability | Feature | ISE 2.x | ISE 3.x |
Cloud Support |
Cloud native ISE |
Previously, ISE could only be deployed on a physical or a virtual appliance. |
Now, you can deploy ISE on public cloud infrastructure including AWS, Azure and Oracle cloud as a native cloud solution. This can help you reduce operational expenses and gives you the ability to scale your deployment on-demand while automating routine tasks. |
Policies for Azure AD |
Previously ISE supported Azure AD identity provider using SAML and Oauth authentication protocols but there was limited support for dot1x |
Now, Cisco ISE 3.x supports EAP-TLS and TEAP authentication with Azure AD. This means that you can now create policies using group and attribute information when performing dot1x authentication which allows for differentiated and secure access. |
|
Automation and APIs |
Open API for system and policy management |
Previously, API only exposed basic ISE infrastructure and session related content |
With Open API support, ISE 3.x brings you a lot more automation capabilities such as policy and system management (like backups) while still supporting the other types of APIs |
Zero Touch Provisioning |
The traditional way of deploying ISE had several touch points and was a manual process. It took several hours setting up a large deployment |
Now, the new Zero Touch Provisioning (ZTP) allows you to create a configuration file in which the ISE node can be configured (IP, hostname, DNS, etc.) Likewise, it can automatically install any hot fixes or patches immediately after it is set up. |
|
Posture and Compliance |
Posture on Linux |
Previously, ISE Posturing could be performed on Windows and OS X machines. |
ISE Posture can now be performed for Linux devices too, along with Windows and OS X. That way, all endpoints on the network can be kept compliant and, if found non-compliant, they can be quarantined and remediated. |
Agentless Posture |
Previously you had to have an application installed on the endpoint to perform posture checks |
By popular request, ISE can now be configured to assess the posture of an endpoint without having to roll out client applications across your entire install base. For you this means you gain all the visibility necessary without the need of an additional application. |
Promotion Alert: ISE 3.x offers a streamlined licensing scheme in line with Cisco DNA licensing tiers. Take advantage of the one year free licenses on Cisco limited-time promotion by upgrading your ISE deployment and licenses to version 3.x!
Ask the Experts Recording: Please watch this VoD as our experts walk you through the steps to prepare, perform, and validate a successful ISE upgrade without headaches. Best practices, strategies to minimise downtime and different methods of upgrades for different types of ISE deployments are covered.
Ask the Experts Live: If you would like to ask the questions to one of our ISE experts live in during webinar, please register to one of the Upgrade Planning and Best Practices: Upgrading ISE Ask the Experts sessions.
thank you for the information
Thank you for the information
Thanks for information!
Thank you for sharing! Very helpful topic.
@JOSE ANTONIO ALVAREZ CUBERO ISE already integrates with ACI. Please refer to this PDF Guide and this link.
@Richard Labasbas for the protocol and port reference, take a look at ISE 3.1 Node Communications. The ones incoming to the PSN might be of interest for you.
Very interesting! Thanks for sharing!
GRacias por compartir es una buena información.
Great summary, we are running an early 3.x version is there anything we should be aware of before upgrading?
Hi @Tommo80, I have informed our team to take a look at the link for the promotion.
Hi @davidpeck, please watch the webinar mentioned in the post where we cover the best practices for upgrade. The same steps apply to early 3.x upgrade to later versions of 3.x as well.
Finally we can deploy ISE in the cloud. Is there any limitation for the cloud?
Can we use hybrid deployment and use on-prem and cloud (two instances on-prem and another one in azure)?
How long this promotion for upgrade will be valid? We have got plan to upgrade our ISE to new version on the firs quater next year.
@skozankiewicz Yes you can use hybrid deployment and have a mix of on-prem and cloud ISE nodes. There aren't any specific limitations in terms of major features and all the known limitations are already mentioned in this doc for each of the cloud providers. As far as the promotion goes, it is valid till April 2023 for the converted essential licenses to have an expiry date of October 31, 2024.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: