Field Notice: FN74081 - Identity Services Engine: TC-NAC Services on ISE Will Fail Due to AMP Cloud Deprecation of TLS 1.0 Support - Software Upgrade Recommended

For affected releases of Cisco Identity Services Engine (ISE), Threat Centric-Network Access Control (TC-NAC) services on Cisco ISE will fail due to the deprecation of Transport Layer Security (TLS) 1.0 support on Cisco Advanced Malware Protection (AMP) Cloud starting on March 31, 2024.

TLS 1.0 support will be deprecated on Cisco AMP Cloud starting on March 31, 2024. Cisco AMP Cloud will continue to support later versions of TLS. Existing Cisco ISE releases support only TLS 1.0 with Cisco AMP Cloud and, as a result, Cisco ISE integration with Cisco AMP Cloud will be impacted after the deprecation date.

Cisco AMP adapter status shows a Disconnected state and will not allow further configuration.

Go to Administration > Threat Centric NAC > Third Party Vendors.

A log message similar to the following example will also be displayed in irf.log from the Admin console:

show logging application irf.log

INFO  [admin-http-pool15][[]] cpm.irf.rest.engine.IRFCoreRestClient:info:122 -::::::- Returning result: {adapterUuid=f4a41add-f370-49d3-8a74-1941992f3150, instanceUuid=f08b5a03-f384-4a84-a69d-a325da3dab67, name=AMP1, state=Registered, adapterType=THREAT, adapterVersion=1.0, vendor=AMP, status=Configuration in progress, message=, hostname=https://api.amp.sourcefire.com, connectivity=Disconnected}

Workaround

There is no workaround for this issue.

Solution

To address this issue, Cisco ISE has migrated from TLS 1.0 to TLS 1.2 support. Cisco recommends upgrading to one of the following Cisco ISE releases to obtain TLS 1.2 support:

• 3.1 Patch 8 or later (for 3.1 Patch 8, a special configuration may be required as noted below)
• 3.2 Patch 5 or later (estimated release date: second half of Feb 2024)
• 3.3 Patch 1 or later

There is no plan to backport TLS 1.2 support for Cisco ISE releases 3.0 and earlier.

Configuration for Cisco ISE Release 3.1 Patch 8

The steps below are only required for customers who currently have TC-NAC services enabled. For customers who do not currently have TC-NAC services enabled, the steps below are not required.

1. Go to Administration > System > Deployment.
2. Select the node that has TC-NAC services enabled.
   
3. Disable TC-NAC services by unchecking Enable Threat Centric NAC Service and clicking Save.
4. After disabling TC-NAC services, please wait five minutes before re-enabling.
5. Re-enable TC-NAC services by checking Enable Threat Centric NAC Service and clicking Save.