Channel Title: Cisco ISE - Identity Services Engine Channel Description: Welcome to the Official Cisco ISE YouTube Channel. Cisco ISE is an All-in-One solution that helps define and enforce policy across Wired, Wireless & VPN Networks. Learn more: https://www.cisco.com/go/ise Get answers to your ISE questions by visiting the customer community @ https://cs.co/ise-community Follow Us On Twitter: @CiscoISE Subscribe to Cisco ISE's YouTube channel: https://www.youtube.com/subscription_center?add_user=ciscoise <video> Device Administration with ISE Description: Cisco Security Consulting Engineer Emmanuel Cano provides an introduction to Device Adminstration with the TACACS+ protocol in Cisco ISE. 00:00 Intro & Agenda 01:40 Role Based CLI Access (Parser View) Challenges 03:15 TACACS+ Basics : https://datatracker.ietf.org/doc/html/rfc8907 03:55 TACACS+ vs RADIUS 06:00 Device Admin with RADIUS 08:13 Device Administration with Third Party Devices 10:32 Device Admin with TACACS+: 11:00 - Allowed Protocols 11:55 - Command Sets with Wild Cards & Regex 13:07 - Shell Profiles 14:00 Enable Device Admin & Licensing 15:48 TACACS+ ASA Config 18:28 TACACS+ IOS Config 21:47 Single Connect Mode 25:33 Device Admin with an External Proxy Server 27:24 Demo: ISE Device Admin with an External Proxy Server and Active Directory 27:27 - Active Directory 28:02 - ISE #1: Proxy Server 30:54 - ISE #2: TACACS Server, Active Directory, Command Sets, and Shell Profile 35:16 - ASA Configuration and Test 38:54 TACACS+ with Duo MFA 40:56 Demo: TACACS+ with Duo MFA 42:10 - Duo Dashboard with application Cisco ISE RADIUS 47:00 - ISE with Duo as RADIUS Token Server 49:12 - ISE Command Sets, Shell Profiles, Authorization Policy 51:08 - CSR1Kv Configuration and Test 56:53 TACACS+ with ISE and Azure AD requires Microsoft NPS to talk with Azure MFA via API 58:18 Questions </video> <video> ISE & Duo Enhanced Integration for MFA Description: Cisco ISE Technical Marketing Engineer, Thomas Howard, explains the latest native API-based integration of Duo with ISE 3.3+Patch1 for VPN and TACACS+ user authentication. Topics: 00:00 Intro and Agenda 00:32 ISE Releases and Patches 01:38 ISE Patches Contain Features 02:30 Zero Trust 03:17 ISE for Zero Trust in the Workplace 04:20 Network Access Authentication Spectrum 07:50 The Need for MFA with VPN 08:44 ISE & Duo Integration with Duo Authentication Proxy 10:00 ISE 3.3.1 with Duo API Integration 11:20 MFA Requires a Finger and Phone 12:09 ISE and Duo are Complementary for Zero-Trust On-Premises and Cloud 12:57 Get a Duo Account @ https://signup.duo.com 14:00 Login to Duo @ https://admin.duosecurity.com 14:10 Demo: Setup Duo Admin API and Auth API for ISE 3.3.1 Note: Requires 🔒Duo Owner/Administrator Account Permission! 15:43 Demo: Configure Duo MFA Integration in ISE with Active Directory 19:22 Demo: VPN Policy Configuration Update and Test with Duo MFA 23:12 Enhanced ISE + Duo Integration for MFA feature roadmap 25:39 The Need for MFA with Device Administration (TACACS+) 28:07 TACACS+ Protocol 29:02 Secure RADIUS & TACACS+ with Native IPsec Tunnels: https://cs.co/ise-ipsec 30:10 ISE Supports TACACS+ and RADIUS 30:58 Demo: Device Administration/TACACS+ Configuration with MFA 36:05 Configure ISE 3.3 Native Multi Factor Auth with Duo 36:28 Device Administration Prescriptive Deployment Guide: https://cs.co/ise-tacacs 36:37 Partners: Cisco dCloud ISE 3.3 Enterprise & Security Demo 38:04 ISE 2.x to 3.x License Migration Offer Resources - ISE Software & Patch Download: https://cs.co/ise-software - Get a Duo Account @ https://signup.duo.com - Device Administration Prescriptive Deployment Guide: https://cs.co/ise-tacacs - Configure ISE 3.3 Native IPSec to Secure NAD (IOS-XE) Communication:: https://cs.co/ise-ipsec - Cisco dCloud Demos (Cisco Partners & Employees): https://dCloud.cisco.com </video> <video> What's New in ISE 3.4? Description: Cisco ISE Technical Marketing Engineer (TME), Charlie Moreton, covers all of the features coming in ISE 3.4. Topics: 00:00 Intro 00:18 Upcoming ISE Milestones: https://cs.co/ise-eol - 3500 End of Support - ISE 3.0 End of Maintenance - ISE 2.7 End of Support - ISE 3.3 Patch is the Suggested Release 01:41 ISE 3.4 Feature Summary and Release Guesstimates 03:05 Improved ISE 3.4 Restart Times 05:53 Persistent User Table & Column Preferences with Demo 08:16 PAC-less TrustSec Communication 12:30 TLS 1.3 Support for EAP-TLS, TEAP-TLS, Secure Syslog 13:18 pxGrid Direct Enhancements - ISE pxGrid Direct with CMDBs: https://youtu.be/g8fzBPY8gU8 - Sync Now - URL Pusher & APIs 17:35 Demo: pxGrid Direct URL Pusher 23:42 Common Policy Overview 25:23 Roadmap 26:47 ACI Integration Updates 29:05: Demo: ISE with ACI and APIC 34:21 Debug Log File Management 36:14 Active Directory Preferred Domain Controller 38:30 ISE 2.x to 3.x Migration Offer: https://cs.co/ise-licensing </video> <video> Scaling ISE Deployments for Success Description: Patrick Lloyd, Senior Solutions Architect for Cisco Security Services and Co-Author of the book Zero Trust Architecture dives into how Advanced Services approaches design for Identity with Identity Services Engine. Topics: 00:00 Intro & Agenda 01:32 Zero Trust Capabilities: - Policy & Governance - Identity - Vulnerability Management - Enforcement - Analytics 04:03 Journey of Zero Trust 04:36 Security Onion 05:07 Scaling Resources 06:15 Use Cases / Methodology 07:27 Scaling of ISE Sessions: Wired, Wireless, IOT/Posture/Phones 08:43 IOT Camera Example 11:02 Scaling Based on Authorization 11:36 Example Calculation: 10K Wired + 10K Wireless + 5K loT Endpoints 16:09 Example Calculation: 20K IOT Endpoints 16:56 Unknown Endpoints 17:38 Onboarding Processes 19:27 Scaling Accuracy 20:21 Trust Boundaries (TrustSec Segmentation) and Enforcement Techniques 21:57 Scaling by Authentication Methods 22:24 Existing ISE Deployment Scale: Use Key Performance Indicators (KPIs) - Load - Transactions - Latency 25:16 Trends with Median & Mode per PSN 26:05 Maximum Load 27:43 Cisco Security Services 30:12 ISE Resources (see below) 31:10 Question: Do we have a specific calculator for ISE scale? 33:20 Question: What is the best strategy for organizing your policy? 37:15 Questions: Are there implementations best for multiple ISE clusters (deployments) rather than a single, large deployment? Resources Zero Trust Architecture Book http://cs.co/Zero-Trust-Architectures-On-Amazon http://cs.co/Zero-Trust-Architectures-Barnes-and-Noble ISE Performance & Scale: https://cs.co/ise-scale ISE BERG (Big Encyclopedic Resources Guide): https://cs.co/ise-berg ISE Webinars: https://cs.co/ise-webinars CiscoISE YouTube Channel: https://cs.co/ise-youtube ISE Bar Public Webex Space: https://cs.co/ise-bar </video> <video> Random MAC Addresses and How to Identify Them Description: ISE TME Charlie Moreton dives into MAC addresses and explains the unique characteristics of Random MAC addresses. 0:11 Anatomy of a MAC address 0:34 BLOCK_ID and DEVICE_ID 1:34 What a Random MAC address means to users and NAC Administrators 2:21 Breaking down a Random MAC address 3:01 Identifying a Random MAC address IETF 114 - MADINAS WG MAC address randomization whitepaper https://datatracker.ietf.org/doc/draft-ietf-madinas-mac-address-randomization/ </video> <video> ISE Posture Compliance - Part 1 Description: Cisco Identity Services Engine (ISE) Technical Marketing Engineer (TME) Pavan Gupta shares how to do Posture Compliance with Cisco Secure Client (CSC)/AnyConnect. Topics: 00:00 Intro & Agenda 00:48 Security Compliance Using ISE Posture Webinar: https://youtu.be/0NCkVAjAkq8 01:15 Security Compliance 01:59 ISE Compliance Services: Posture, MDM, TC-NAC 02:18 ISE Posture Compliance Service 05:37 Remediation 07:20 Posture Deployment Options 07:55 Posture Workflow: Preparation, Configuration, Monitoring & Reporting 12:50 Network Access Devices and Groups: https://youtu.be/cP7nhIJSz24 13:54 ▷ Demo: NDGs and NADs 15:31 Posture Updates 17:44 ▷ Demo: Proxy Service, Posture Updates, Operations Audit 19:50 Posture General Settings 20:18 Posture Configuration: Deploying Agents, Configuration, & Profiles 21:12 Agent Types: Persistent, Stealth, Temporal, Agentless 25:25 Posture Agent Process: Download, Discovery, Evaluation 28:00 Posture Redirection Flow for Agent Download 31:55 ▷ Demo: Client Provisioning with Cisco Secure Client for Windows 35:35 ▷ Demo: Access Policies 40:40 Agent PSN Discovery Process: Redirection & Redirection-less 45:50 Posture Redirection Comparison 47:41 Posture Flow After Disovery 49:25 ▷ Demo: Posture Redirection Flow 56:02 ▷ Demo: Posture Redirection-less Flow 1:02:10 ▷ Demo: Default Posture Policies 1:06:12 Custom Posture Policies 1:08:42 Posture Policy Examples 1:10:10 ▷ Demo: Custom Posture Policies 1:19:45 Monitoring & Reporting 1:21:10 ▷ Demo: Live Logs & Live Sessions 1:22:52 ▷ Demo: Dashboard, Context Visibility, Posture Reports 1:25:22 ▷ Demo: Data Connect 1:30:33 NAD Dependency: - https://cs.co/ise-compatibility - https://cs.co/ise-interop 1:32:39 Upcoming: ISE Posture Compliance - Part 2 1:35:25 Resources: ISE Posture Prescriptive Guide: https://cs.co/ise-posture ISE Big Encyclopedic Resources Guide: https://cs.co/ise-berg ISE YouTube Channel: https://cs.co/ise-youtube ISE Webinars: https://cs.co/ise-webinars ISE Community: https://cs.co/ise-community ISE NAD Capabilities: https://cs.co/nad-capabilities Does ISE Support My Network Device?: https://cs.co/ise-interop ISE Troubleshooting Tech Notes: https://cs.co/ise-troubleshooting ISE Licensing & Evaluations: https://cs.co/ise-licensing </video> <video> IBNS 2 0 Switch Templates for ISE Description: Brad Johnson, Cisco Security Consulting Engineer, shares his tips for configuring switches with ISE from his years of experience. 00:00 Intro & Agenda 02:45 IBNS (Identity Based Networking Services) Overview 03:40 IBNS 2.0 Features 05:48 Template Configurations 07:28 RADIUS Configuration 11:38 AAA Configuration 15:26 Demo: RADIUS Configuration and Test 17:02 Device Tracking Overview & Configuration 22:18 Device Sensors Overview & Configuration 26:37 Demo: Endpoint Before and After Device Tracking & Sensor 28:58 Service Templates and Class Maps 31:10 Policy Maps 33:03 Demo: Service Templates, Class Maps, Policy Maps 33:47 Converting to IBNS 2.0 34:35 Demo: Display and Convert Policy Maps 35:58 Demo: Convert without Per-Port Policy Maps 37:20 Switchport Templates: Monitor, Low-Impact, Closed Modes 40:34 Demo: Applying Port Templates 41:32 Concurrent MAB & 802.1X 42:50 Demo: Concurrent MAB & 802.1X with Different Clients 44:48 ISE Resources 45:42 Questions - Will the Device Tracking configuration update from IOS-XE 15 to 16? - Disable IP tracking on a trunks? - Disable IP helper with Device Sensor? - What if DHCP is not used? - Does concurrent authentication use more licenses? - Is concurrent auth just making the MAB priority higher? - Do you enable LLDP on your switches? - What happens if your remove the test-user account? Resources - Brad's ISE Support Site: https://ise-support.com - ISE BERG (Big Encyclopedic Resources Guide): https://cs.co/ise-berg - ISE Wired Prescriptive Deployment Guide: https://cs.co/ise-wired - ISE Webinars: https://cs.co/ise-webinars - CiscoISE YouTube Channel: https://cs.co/ise-youtube - ISE Bar Public Webex Space: https://cs.co/ise-bar </video> <video> ISE Endpoint Profiling with Network Packet Analyzers Description: Cisco Technical Marketing Engineer, Taylor Cook explains how to use open source tools like Python and Wireshark to gain additional profiling insights on endpoints to create granular security policies within ISE. Topics: 00:00 Intro and Agenda 01:20 Slido Poll: What tools do you use for Profiling today? 03:08 Slido Poll: Skill assessment with Wireshark and Python 05:12 Profiling Overview: Your Network + Your Data = Better Profiling 08:26 Switch Profiling Configuration 10:26 ISE Profiling Probes 10:50 Cisco Platform Exchange Grid (pxrGrid) Probe for Profiling 11:30 Enabling ISE pxGrid Persona for IOTAsset attributes 13:00 ISE APIs: REST (https://) and Websockets (wss://) 14:38 pxGrid APIs and Differences 16:32 Existing Python Tools for pxGrid: `pxgrid-util` @ https://github.com/cisco-pxgrid/python-advanced-examples 19:32 Certificates & pxGrid 21:20 Demo: Generate ISE pxGrid Certificates 23:22 Gathering Endpoint Data with ISE Profiling 24:32 Add Collectors to Gather Data via SPAN or ERSPAN 25:46 Network Packet Analyzers: Wireshark, tshark, and pyshark: `pip install pyshark` 27:30 pyshark Usage and Live Capture Example 31:59 Putting the Pieces Together for Improved Profiling Data 35:07 New Profile Definitions in ISE with IOTAsset attributes 36:19 Demo: ISE 3.3 with Multi-Factor Classifications (MFCs) ```sh pxgrid_pyshark \ -a ise33.cisco.local \ -n ise-pyshark \ -c ISE-pyshark.cer \ -k ISE-pyshark.key \ -s ISE33.cisco.local.pem \ -interface ene \ --verbose ``` 39:52 Next Steps / Requirements / Caveats https://github.com/taylor-cook/pxgrid-pyshark `pip install pxgrid-pyshark` 43:09 Demo: Ubuntu Collector Setup ```sh sudo apt-get update sudo apt install python3-pip -y sudo apt install tshark -y sudo pip install pxgrid-pyshark ``` 47:18 Demo: Existing PCAP File ```sh sudo pxgrid-pyshark-file ``` 49:21 Recommendations and ERSPAN Example with ACL ```ios ip access-list extended ERSPAN-ACL 10 permit udp any any eq 5353 20 permit udp any any eq 1900 30 permit udp any any eq 5060 40 permit tcp any any eq 80 50 permit tep any any eq 8080 60 permit udp any any eq 138 exit monitor session {id} type erspan-source source interface {int x/x} rx source interface {int x/y - z} rx filter ip access-group ERSPAN-ACL destination erspan-id {erspan-id} ip address {collector ip} exit no shut end ``` 51:30 References DEVNET-2292 ISE APIs in Practice pxgrid-pyshark Github: https://github.com/taylor-cook/pxgrid-pyshark pyshark documentation: https://pypi.org/project/pyshark/ pxgrid-util documentation: https://pypi.org/project/pxgrid-util/ ISE Performance and Scale Guide: https://cs.co/ise-scale Apple Product models/names - https://theapplewiki.com IEEE OUI Database: https://standards-oui.ieee.org Regex Tools: https://Regex101.com and https://regex-generator.olafneumann.org pxGrid Reference - https://github.com/cisco-pxgrid/pxgrid-rest-ws/wiki pxGrid Developer Resources: https://developer.cisco.com/docs/pxgrid CLI Utility: https://github.com/vbobrov/pxgrid-api 52:12 ISE Resources ISE 3.4 Beta: https://cs.co/ise-openbeta Cisco ISE 2.x to 3.x License Migration Offer for Customers: https://cs.co/ise-licensing ISE Webinars: https://cs.co/ise-webinars ISE YouTube Channel: https://cs.co/ise-videos ISE Resources: https://cs.co/ise-resources ISE Community: https://cs.co/ise-community ISE Security Integration Guides: https://cs.co/ise-guides ISE NAD Capabilities: https://cs.co/nad-capabilities Does ISE Support My Network Device?: https://cs.co/ise-interop ISE Troubleshooting Tech Notes: https://cs.co/ise-troubleshooting ISE Licensing & Evaluations: https://cs.co/ise-licensing </video> <video> ISE Posture Compliance - Part 2 Description: Cisco ISE TME, Pavan Gupta, continues his feature coverage and demos of Posture Compliance. Topics: 00:00 Introduction 00:16 Announcements and Milestones: https://cs.co/ise-eol - 2024-06-30 SNS-3500 Last Date of Support - 2024-07-13 ISE 3.0 End of Software Maintenance - 2024-09-22 ISE 2.7 End of Support - ISE 3.2 Patch 2 is Suggested Release: https://cs.co/ise-software - ISE 3.4 Release Guesstimate 01:55 Review ISE Posture Compliance, Part 1 Topics: https://youtu.be/As6SEUHFzV8 02:33 Agenda 03:14 Posture Global Settings and Agent Profile Override 04:36 Demo: Global Settings 06:40 Posture Lease 10:20 Demo: Posture Lease 14:30 Flexible Grace Period 17:59 Demo: Flexible Grace Period 23:28 Periodic Reassessment 24:19 Demo: Periodic Reassessment 28:21 Demo: Stealth Agent Posture Workflow 31:52 Agentless Posture Workflow 34:40 Demo: Agentless Posture workflow 43:40 Temporal Agent Posture workflow 44:59 Demo: Temporal Agent Posture workflow 50:49 Posture Deployment Options and Comparison Summary 51:55 Demo: Log Analytics - New Posture Dashboards in ISE 3.4! 55:49 Resources: - ISE Posture Prescriptive Guide: https://cs.co/ise-posture - ISE BERG (Big Encyclopedic Resources Guide): https://cs.co/ise-berg - ISE Webinars: https://cs.co/ise-webinars - ISE YouTube Channel: https://cs.co/ise-videos - ISE Resources: https://cs.co/ise-resources - ISE Community: https://cs.co/ise-community - ISE NAD Capabilities: https://cs.co/nad-capabilities - ISE Troubleshooting Tech Notes: https://cs.co/ise-troubleshooting - ISE Licensing & Evaluations: https://cs.co/ise-licensing </video> <video> Cisco ISE Integration with Splunk Description: Cisco ISE TME Pavan Gupta shares his experiences in integrating ISE and Splunk. 00:00 Intro & Agenda 01:15 Overview of Splunk 08:36 Splunk Installation & Capabilities 09:14 Demo: Install Splunk Enterprise on Windows 12:20 Demo: Install Splunk Enterprise on Linux 15:15 Splunk for ISE 18:30 ISE Configuration: Send Syslogs to Splunk 20:00 Demo: Splunk for Cisco Identity Services (ISE) 20:15 - Remote Logging Target 23:00 - Logging Categories 24:16 - Collection Filters 25:10 - Install Splunk 26:50 - Authentication Events: 802.1X + Posture on Linux and Windows 28:57 - Splunk 32:40 Syslog Data Collection: https://docs.splunk.com/Documentation/SVA/current/Architectures/Syslog 33:18 Demo: Searching Splunk for Passed vs Failed Authentications 39:05 - Find endpoints by TLS versions 42:03 - BYOD RegisteredEndpoints 42:54 - MDM Endpoints 43:49 - Endpoints per SSID 44:38 Splunk for Cisco Enterprise Networking App 46:30: Demo: Enterprise Networking App 51:05 Splunk DB Connect App with ISE Data Connect 52:44 Demo: Splunk DB Connect + ISE Data Connect 59:53 Splunk SOAR (Security Orchestration, Automation, and Response) 1:04:29 Demo: Splunk SOAR 1:20:39 Resources - Splunk with ISE : https://cs.co/ise-berg#splunk - Splunk for Cisco Identity Services (ISE) : https://splunkbase.splunk.com/app/1589 - Splunk Add-on for Cisco Identity Services : https://splunkbase.splunk.com/app/1915 - Splunk DB Connect: https://splunkbase.splunk.com/app/2686 - Splunk DBX Add-on for Oracle DB JDBC: https://splunkbase.splunk.com/app/6151 - Identity Services Engine and Splunk Apps Configuration Guide - ISE Syslogs: https://cs.co/ise-berg#syslog - Syslog Data Collection: https://docs.splunk.com/Documentation/SVA/current/Architectures/Syslog Splunk Queries: ``` source="udp:514" OR source="udp:515" eventtype="cisco-ise-authentication* eventtype="*" MESSAGE_CLASS="Failed-Attempt OR MESSAGE_CLASS="Passed-Authentication" | stats count by MESSAGE_CLASS source="udp:515* eventtype="cisco-ise" TLSVersion=* | timechart count by TLSVersion source="udp:515" eventtype="cisco-ise" TLSVersion=* Calling_Station_ID="*" TLSCipher="*" | stats count by Calling_Station_ID TLSVersion TLSCipher IdentityGroup="Endpoint Identity Groups:RegisteredDevices" EndPointMACAddress="*" | fields EndPointMACAddress | stats count by EndPointMACAddress source="udp:515" MESSAGE_CLASS="MDM" MDMCompliantStatus EndPointMACAddress="*" | stats values(*) as * by EndPointMACAddress | stats count by MDMCompliantStatus eventtype="cisco-ise-authentication" NAS_Port_Type="wireless - IEEE 802.11" NAS_Identifier="*" | stats values(*) as * by NAS_Identifier | fields NAS_Identifier Calling_Station_ ID ``` </video> <video> ISE API and Automation Setup Description: Cisco ISE TME Charlie Moreton helps get you started with APIs and automation for ISE using curl, VSCode, and Ansible. 00:00 Intro and Previous ISE API & Automation Webinars ▷ ISE REST APIs Introduction: https://youtu.be/iauFLdiUPQk ▷ Practical ISE Automation with Ansible: https://youtu.be/GnJDuuia-Vk ▷ ISE 3.1 APIs, Ansible, and Automation: https://youtu.be/V3dnEAcywZE ▷ Cloud-based Load Balancers with ISE: https://youtu.be/SSOa75rGofk ▷ ISE in a Hybrid Cloud Environment: https://youtu.be/YZ1SYN1LbeQ ▷ Automated ISE Provisioning and Patching: https://youtu.be/Afv7eRLqLT8 ▷ Upgrading ISE in the Cloud with Automation: https://youtu.be/XC8QuE0kbHw 03:32 What is a REST API? 04:43 ISE API Admins and Groups 07:04 Admin Password Expiration ⚠ 07:51 curl https://curl.se 08:56 Environment Variables 10:44 Text Editors and Integrated Development Environments (IDEs) VSCodium: https://vscodium.com (open source VSCode without telemetry tracking) Microsoft VSCode: https://visualstudio.microsoft.com/ 11:36 Demo: Use codium, environment variables, and curl 14:57 - create a networkdevice : POST https://$ISE_PPAN/ers/config/networkdevice 18:09 - get networkdevice : GET https://$ISE_PPAN/ers/config/networkdevice 19:27 - update the entire networkdevice : PUT https://$ISE_PPAN/ers/config/networkdevice/{id} 20:46 - update only specific attributes : PATCH https://$ISE_PPAN/ers/config/networkdevice/{id} 23:22 - delete a networkdevice PATCH https://$ISE_PPAN/ers/config/networkdevice/{id} 23:53 Elements of a curl REST API Request on the Command Line 26:29 Network Device representation in GUI, XML, and JSON 27:16 HTTP Request Methods 28:15 REST API Resource URL Terminology 31:27 REST Request and Response Bodies 34:24 List of ISE REST API Resources : https://cs.co/ise-api 35:21 ISE 3.1+ API Gateway 37:32 Demo: ISE 3.1+ Swagger Utility for OpenAPIs 38:16 Demo: Repository GET / POST / DELETE 44:01 HTTP Status Codes 45:16 Ansible Installation & Overview 46:55 YAML networkdevice Example 49:14 Ansible Concepts 52:54 Ansible Collections and Documentation: cisco.ise 56:16 Ansible Related VSCode Extensions & Tidbits 57:03 Demo: Ansible aws_ec2.yaml inventory file 59:00 Demo: Python and Ansible Installation 1:01:50 Demo: Ansible Inventory 1:03:14 Demo: Ansible Config (ansible.cfg) 1:03:46 Demo: Ansible vars 1:04:50 Demo: Ansible playbook: ise_create_network_device.yaml Resources https://github.com/ISEDemoLab/ISE_API_and_Automation_Setup https://cs.co/ise-api https://cs.co/ise-bar https://cs.co/ise-webinars https://cs.co/ise-berg#api https://cs.co/ise-berg#automation </video> <video> How to Get Data Out of ISE Description: Cisco Identity Services Engine (ISE) TME Thomas Howard covers some of the many ways to get data from ISE using different methods for different needs. 00:00 Intro & Agenda 02:17 Method Comparison 04:30 Comma Separated Values 05:51 Demo: CSV Import, Templates, Export 09:34 `application configure ise` and Context Visibility for Endpoints 12:04 Demo: `application configure ise`, [16]Get All Endpoints 14:18 syslogs - RFC-5424 The Syslog Protocol: https://datatracker.ietf.org/doc/html/rfc5424 15:19: Demo: syslogs, Remote Logging Targets, Logging Categories 21:16 ISE with Splunk integrations - App: https://splunkbase.splunk.com/app/4740 - Documentation: https://splunk.github.io/splunk-connect-for-syslog/ 21:52 ISE REST APIs : https://cs.co/ise-api 22:58 ISE REST APIs Introduction Webinar & Repository 23:48 devnetsandboxise.cisco.com Always-On Demo Instance REST Username: readonly REST Password: ISEisC00L 25:04 Demo: ISE REST APIs with curl and Python Scripts - Terminal app: Warp @ https://warp.dev - ISE ERS API Examples: https://community.cisco.com/t5/security-knowledge-base/ise-ers-api-examples/ta-p/3622623 - ISE Monitoring API Examples: https://community.cisco.com/t5/security-knowledge-base/ise-monitoring-api-examples/ta-p/4800437 - xq (XML Query): https://github.com/sibprogrammer/xq - https://$ISE_PPAN/api/v1/patch - https://$ISE_PMNT/admin/API/mnt/Session/ActiveCount - https://$ISE_PMNT/admin/API/mnt/Session/ActiveList - https://$ISE_PMNT/admin/API/mnt/Session/UserName/thomas - ISE Python Scripts https://github.com/1homas/ISE_Python_Scripts - ise-get.py endpointgroup -f table --details --noid - ise-get.py all -v --details -f yaml --save data/ise_config 39:28 Cisco Platform Exchange Grid (pxGrid) and Sync vs Async Events 41:23 Demo: Enable pxGrid in ISE with Username+Password Authentication - Terminal app: Warp @ https://warp.dev 44:48 Demo: pxgrid-util : session-query-all, px-subscribe - Cisco pxGrid: https://github.com/cisco-pxGrid - pxgrid-util @https://github.com/cisco-pxgrid/python-advanced-examples 48:32 ISE Data Connect - OpenAPI: https://cs.co/ise-api#!data-connect-openapi - Guides: https://cs.co/ise-dataconnect 52:07: Demo: ISE Data Connect SQL Queries - iseql.py --help - iseql.py "SELECT view_name FROM user_views ORDER BY view_name ASC" - iseql.py "SELECT view_name FROM RADIUS_ACCOUNTING" - iseql.py "SELECT status,username,is_admin,password_never_expires FROM network_access_users" - iseql.py "select location, sum(passed_count) as passed, sum(failed_count) as failed, sum(passed_count) + sum(failed_count) as total, round(to_char(((sum(failed_count) / (sum(passed_count) + sum(failed_count))) * 100)), 2) as failed_percentage, round(to_char(sum(total_response_time)/(sum(passed_count) + sum(failed_count))), 2) as total_response_time, max(max_response_time) as max_response_time from radius_authentication_summary group by location" Resources - ISE Webinars: https://cs.co/ise-webinars - ISE YouTube Channel: https://cs.co/ise-videos - ISE Resources: https://cs.co/ise-resources - ISE Community: https://cs.co/ise-community - ISE Encyclopedic Resource Guide: https://cs.co/ise-berg - ISE NAD Capabilities: https://cs.co/nad-capabilities - Does ISE Support My Network Device?: https://cs.co/ise-interop - ISE Troubleshooting Tech Notes: https://cs.co/ise-troubleshooting - ISE Licensing & Evaluations: https://cs.co/ise-licensing </video> <video> ISE Threat Centric NAC Service Description: Cisco ISE TME Pavan Gupta demonstrates how to integrate Cisco Secure Endpoint, Qualys, Rapid7, and Tenable with ISE for Threat-Centric NAC (TC-NAC). 00:00 Intro and Agenda 00:34 What is Compliance? 01:40 ISE Compliance Services (Posture, MDM, TC-NAC) and Licensing 02:53 Threat-Centric NAC Service and Integrations: - Vulnerability Management: Qualys, Rapid7, Tenable - Threats: Cisco Secure Endpoint 07:26 ISE Threat Dictionary and Attributes 08:15 How it Works 10:06 Case 1: When ISE has no vulnerability info 11:47 Case 2: Vulnerability info is present in ISE 13:52 Case 3: Vulnerability info in ISE is beyond X configured hours 15:06 Case 4: Reassess Vulnerability Info 16:16 Cisco ISE + Vulnerability Management Vendor Integration - TC-NAC Service can be enabled on single ISE Node in a deployment 17:50 Tenable Integration Overview 22:54 Demo: Enable ISE TC-NAC Service 24:35 Demo: ISE and Tenable Integration 39:34 Qualys Integration Overview 43:39 Demo: ISE and Qualys Integration 53:30 Rapid7 Integration Overview 54:30 Cisco Secure Endpoint Overview 1:00:10 Demo: Cisco Secure Endpoint 1:05:38 ISE 2.x to 3.x License Migration Offer | https://cs.co/ise-licensing 1:07:09 Question: How much network load does a network scan produce? Resources https://cs.co/ise-guides#CSE https://cs.co/ise-guides#Qualys https://cs.co/ise-guides#Rapid7 https://cs.co/ise-guides#Tenable </video> <video> ISE Live Q&A Description: The Cisco ISE TMEs and CX engineers answered your questions live. Listen for the answers and get the mentioned resources linked below! 00:00 Introduction by Thomas Howard 00:43 Charlie Moreton 01:35 Pavan Gupta 02:25 Jonathan Eaves 03:30 Jon Hamilton 03:55 Ayo Oluwase 04:24 Q: When will ISE 3.3 Patch 1 be released? 05:16 Q: How to allow Active Directory Domain Computers and Users? - ISE Secure Wired Access Prescriptive Deployment Guide : https://cs.co/ise-wired - ISE Authentication & Authorization Policy Reference : https://community.cisco.com/t5/security-knowledge-base/ise-authentication-and-authorization-policy-reference/ta-p/3850472 - ISE Resources : https://cs.co/ise-resources 07:42 Hsing-Tsu Lai 09:45 Q: Is there any way to do bulk CoA (RADIUS Change of Authorization) - ISE APIs : https://cs.co/ise-api - Using API calls for Session Management : https://developer.cisco.com/docs/identity-services-engine/v1/#!using-api-calls-for-session-management 12:37 Q: Is the GUI upgrade from 2.7 to 3.2 a bad idea versus doing a backup and restore? ▷ Cisco ISE New Split Upgrades : https://youtu.be/D7poFnsd-8U ▷ Upgrading your Cisco ISE Deployment : https://youtu.be/q2JpC8oNssA 17:02 Q: What is the recommended upgrade procedure from 3.1 to 3.2? Reimage with backup and restore? - Deploy Cisco Identity Services Engine Natively on Cloud Platforms 18:11 Q: A customer has Cisco DNA Center [now Catalyst Center] with Essentials License. If we want to integrate ISE, what features will a customer get? ▷ Cisco SD-Access with ISE : https://youtu.be/zOcIWUpqZQk 20:15 Q: We can do a Policy export in ISE. How can we import Policy into ISE? ▷ Building ISE RADIUS Policy Sets : https://youtu.be/K4ZxoR8EQbQ ISE Policy OpenAPI : https://cs.co/ise-api#policy-openapi 25:45 Q: Well, then why do we have the ISE Policy Export function? 27:53 Q: Why are end users are getting a certificate warning despite having certificates from both domains in their computers? ▷ Cisco ISE Troubleshooting, Part 1 : https://youtu.be/AxgtXynug_E ▷ Cisco ISE Troubleshooting, Part 2 : https://youtu.be/14ozZzOE_zM ▷ Security Compliance using ISE Posture : https://youtu.be/0NCkVAjAkq8 31:47 Q: How do find the upgrade history for ISE? `show version history` 32:21 Q: Are we planning to reduce the number of supported ISE versions or patches or retire them faster? - ISE End of Life Milestones : https://cs.co/ise-eol - ISE Software Lifecycle Support Statement : https://cs.co/ise-lifecycle 35:55 Q: Is there a way to push out the TEAP settings using Windows GPO? https://cs.co/ise-guides#TEAP 37:22 Q: If there is a CSR on an ISE node waiting to bind, is that CSR cleared if that node is upgraded or does the CSR and private key remain? https://cs.co/ise-guides#certs https://cs.co/ise-guides#PKI 39:55 Q: Are different timezones in the same deployment supported? 43:05 Q: Does the AI/ML profiling in ISE effectively replace Endpoint Analytics? ▷ Getting Started with ISE Profiling : https://youtu.be/OKPGBEMb0w4 45:42 Q: ISE 3.2 shows all the details [CPU, RAM, disk] in Grafana. Is there a way to export it to an external Grafana? Next Generation ISE Telemetry, Monitoring, and Custom Reporting ▷ Part 1 : https://youtu.be/MCDlxMqPw_M ▷ Part 2 : https://youtu.be/dp7HWthncks 48:50 Q: How many network devices do small network deployments handle? ▷ Managing Network Devices in ISE : https://youtu.be/cP7nhIJSz24 ▷ Device Administration with ISE : https://youtu.be/-JvV3POzRvM 51:31 Q: Is it possible to log every command entered on a switch with TACACS+ LiveLogs? 54:32 Q: How to use the ISE Guides document? </video> <video> Upgrading ISE in the Cloud with Automation Description: Cisco ISE TME Charlie Moreton brings you his next installment about automation and ISE by tackling fully automated upgrades of large ISE deployments of 8 and 16 nodes in a hybrid multi-cloud environment! Charlie's ISEDemoLab GitHub Repository used in the webinar: https://github.com/ISEDemoLab/Upgrade_ISE_in_Hybrid_Cloud 00:00 Intro & Agenda 01:42 Yet Another ISE Upgrade Webinar? 03:27 Traditional, 12-node ISE Deployment Upgrade Baseline 04:45 First, 8-node Automated Baseline 05:44 Charlie's Automation Setup: Windows 11, WSL, Ubuntu, VSCode, Windows Terminal, Python, Ansible 07:14 What You Should Know: REST APIs, bash, Ansible, YAML 08:31 How Charlie Sets Up His Environment - GitHub ReadMe: https://github.com/ISEDemoLab/Upgrade_ISE_in_Hybrid_Cloud 11:24 - Environment Variables & Secrets Files 11:59 - Launch VSCode 12:34 - ansible.cfg and task_output_limit 13:43 - Ansible vars (variables) Files 14:36 - Setup Playbooks 17:33 - Git Repository Change Control 20:31 Is it Worth Learning Automation? Why? 21:49 Create 8-Node Hybrid Multi-Cloud ISE Deployment in 3h45m: AWS, Azure, OCI, VMware, enable APIs, add repository, patch, promote PPAN, add SPAN, create node groups, add PSNs, add Certs, Licensing. 24:55 Review Ansible Play Recap Timing for OVA vs ISO (ISO is 30% faster!) 31:02 Where does the Time Go? 32:30 Lessons Learned from Automating Upgrade PreChecks https://github.com/ISEDemoLab/Upgrade_ISE_in_Hybrid_Cloud/blob/main/run_upgrade_prechecks.md 38:43 Review Upgrade Process for ISE 3.2.3 ⮕ 3.3 with IP Address Reuse 42:33 Where the Upgrade Time Goes for 8 Nodes (6h22m) vs 16 nodes (6h35m)! 45:18 Automated Upgrade Process with a Load Balancer 47:29 Load Balancer Configuration in Ansible Playbooks 53:26 upgrade.yaml Playbook 55:05 Notifications via Screen, Email (sSMTP, SWAKS) 1:03:52 Push Notification via https://ntfy.sh 1:09:48 Public Key Authentication for Password Reset Resources - GitHub Repository: https://github.com/ISEDemoLab/Upgrade_ISE_in_Hybrid_Cloud - ISE REST APIs Introduction : https://youtu.be/iauFLdiUPQk - Practical ISE Automation with Ansible : https://youtu.be/GnJDuuia-Vk - Automated ISE Setup with Infrastructure as Code Tools : https://youtu.be/tN_nTEE48Ys - ISE in a Hybrid Cloud Environment : https://youtu.be/YZ1SYN1LbeQ - Cloud Load Balancing with ISE : https://youtu.be/SSOa75rGofk - ISE Webinars : https://cs.co/ise-webinars - ISE Community : https://cs.co/ise-community </video>

Contacts and Links

Description

Welcome to the Official Cisco ISE YouTube Channel.
Cisco ISE is an All-in-One solution that helps define and enforce policy across Wired, Wireless & VPN Networks.

Learn more: https://www.cisco.com/go/ise

Get answers to your ISE questions by visiting the customer community @ https://cs.co/ise-community

Follow Us On Twitter: @CiscoISE

Subscribe to Cisco ISE's YouTube channel:
https://www.youtube.com/subscription_center?add_user=ciscoise

Videos from channel