Configure Cisco DNA Center System Settings

About DNA Center and Cisco ISE Integration

Before you can create and use access control policies, you need to configure DNA Center and Cisco ISE to integrate with one another. The process involves installing and configuring Cisco ISE with specific services and configuring Cisco ISE settings in DNA Center.

After Cisco ISE has successfully registered and its trust established with DNA Center, DNA Center shares information with Cisco ISE. DNA Center device inventory is propagated to Cisco ISE, and whenever you update device credentials in DNA Center, DNA Center updates Cisco ISE with the changes. Similarly, if you change the Radius shared secret for Cisco ISE, DNA Center updates Cisco ISE with the changes. However, Cisco ISE does not share existing device information with DNA Center. The only way for DNA Center to know about the devices in Cisco ISE is if the devices have the same name in DNA Center; DNA Center and Cisco ISE uniquely identify devices for this integration through the device's hostname variable.

DNA Center integrates with the primary Administration ISE node. When you launch Cisco ISE from DNA Center, you connect with this node.

DNA Center polls Cisco ISE every 15 minutes. If the ISE server is down, the 360 Dashboard page shows the Cisco ISE server as red, which means the Cisco ISE server is unreachable.

When the Cisco ISE server is unreachable, DNA Center increases polling to 15 seconds, then doubles the polling time to 30 seconds, 1 minute, 2 minutes, 4 minutes, and so on, until it reaches the maximum polling time of 15 minutes. DNA Center continues to poll every 15 minutes for 3 days. If DNA Center has not regained connectivity, it stops polling, and updates the Cisco ISE server status to Untrusted. If this happens, you will need to reestablish trust between DNA Center and the Cisco ISE server.

Configure Authentication and Policy Servers

Configure Access to a AAA Server

You can configure access to a primary and a secondary AAA server.

Procedure
    Step 1   From the DNA Center Home page, click > System Settings > Settings > Authentication and Policy Servers.
    Step 2   Click + AAA Server.
    Step 3   Configure the primary AAA server:

    • IP Address—IP address of the AAA server.

    • Shared Secret—Key for RADIUS authentications. The shared secret can be up to 128 characters in length.

    • Cisco ISE—Toggle that configures a AAA server or a Cisco ISE server. Leave the toggle set as is. Do not choose Cisco ISE.

    Step 4   Click View Advanced Settings and configure the settings:

    • Protocol—TACACS or RADIUS

    • Authentication Port—Port used to relay authentication messages to the AAA server. The default is UDP port 1812.

    • Accounting Port—Port used to relay important events to the AAA server. The information in these events is used for security and billing purposes. The default UDP port is 1813.

    • Retries—Number of times that DNA Center attempts to connect with the AAA server before abandoning the attempt to connect. The default UDP port is 1814.

    • Timeout—The length of time that DNA Center waits for the AAA server to respond before abandoning the attempt to connect.

    Step 5   Click Add.
    Step 6   To add a secondary AAA server, click + AAA Server and repeat Step 3 through Step 5.

    Configure Access to a Cisco ISE Server

    To use access control policies, you need to configure access to a Cisco ISE server.

    Procedure
      Step 1   From the DNA Center home page, click > System Settings > Settings > Authentication and Policy Servers.
      Step 2   Click + AAA Server.
      Step 3   Configure the Cisco ISE settings:

      • IP Address—IP address of the ISE server.

      • Shared Secret—Key for RADIUS authentications. The shared secret can be up to 128 characters in length.

      • Cisco ISE—Setting that indicates whether the server is a Cisco ISE server. Click the Cisco ISE setting to enable Cisco ISE.

      • Username—Name that is used to log in to Cisco ISE.

      • Password—Password that is used to log in to Cisco ISE.

      • FQDN—Fully qualified domain name (FQDN) of the Cisco ISE server. The FQDN consists of two parts: the hostname and the domain name in the following format:

        hostname.domainname.com.

        For example, the FQDN for a Cisco ISE server might be ise.cisco.com.

      • Subscriber Name—Cisco ISE server name.

      • SSH Key—Diffie-Hellman-Group14-SHA1 SSH key used to connect and authenticate with Cisco ISE.

      Step 4   Click View Advanced Settings and configure the settings:

      • Protocol—TACACS or RADIUS

      • Authentication Port—Port used to relay authentication messages to the AAA server. The default is UDP port 1812.

      • Accounting Port—Port used to relay important events to the AAA server. The information in these events is used for security and billing purposes. The default UDP port is 1813.

      • Retries—Number of times that DNA Center attempts to connect with Cisco ISE before abandoning the attempt to connect.

      • Timeout—The length of time that DNA Center waits for Cisco ISE to respond before abandoning the attempt to connect.

      Step 5   Click Add.

      Device Controllability

      When Device Controllability is enabled and under certain circumstances, DNA Center configures devices with the network settings for the site to which the device belongs.

      When device controllability is disabled, DNA Center does not configure any settings on the devices.


      Note

      Device controllability is enabled by default. If you do not want device controllability enabled, you have to manually disable it. For more information, see Configure Device Controllability.

      Device controllability configures SNMP (SNMPv2c and SNMPv3) credentials and Syslog on devices under the following circumstances:

      • Device in Global Site—When you successfully add, import, or discover a device, DNA Center places the device in the Managed state and assigns it to the Global site by default. Even if you have defined Syslog and SNMP server settings for the Global site, DNA Center does not change the Syslog and SNMP server settings on the device.

      • Device Moved to Site—If you move the device from the Global site to a new site, for example Site A, that has Syslog and SNMP server settings configured, DNA Center changes the Syslog and SNMP server settings on the device to the settings configured for Site A.

      • Device Removed from Site—If you remove a device from a site, for example Site A, DNA Center does not remove the Syslog and SNMP server settings from the device.

      • Device Moved from Site to Site—If you move a device, for example from Site A to Site B, DNA Center replaces the Syslog and SNMP server settings on the device with the settings assigned to Site B.

      After discovering devices and when device controllability is enabled, DNA Center configures the following features and protocols on the devices:

      • SNMP Trap server—If you have Device Controllability enabled, DNA Center configures these SNMP traps for you. Otherwise, you need to enable SNMP traps and configure DNA Center's server IP address as the SNMP server. For information, see SNMP Trap Configuration.

      • IP Device Tracking—DNA Center automatically enables IP device tracking (IPDT) or Switch Integrated Security Features (SISF) on any network device where IPDT is supported and not enabled. DNA Center configures IPDT or SISF IPDT on the device based on the device type and image version that is running.

      • NetFlow controller

      Configure Device Controllability

      Device controllability automatically configures discovered devices with SNMP credentials, SNMP Trap servers, IP Device Tracking, NetFlow, Syslog, and NETCONF. Device controllability is enabled by default. If you want, you can disable device controllability and reenable it at any time. For more information, see Device Controllability.

      Procedure
        Step 1   From the DNA Center Home page, click > System Settings > Settings > Device Controllability.
        Step 2   Click Enable Device Control.

        Configure an IP Address Manager

        You can configure DNAC to communicate with an external IP Address Manager such as Infoblox®.

        Procedure
          Step 1   Click , then select System Settings.
          Step 2   Click the Settings tab, then click IP Address Manager.
          Step 3   In the IP Address Manager (Infoblox) section, click Configure settings for IPAM.
          Step 4   Complete the required fields for your Infoblox server, then click Apply.

          Configure DNA Center with SFTP Server Settings

          To upload files from DNA Center to an SFTP server, you need to configure information about your external SFTP server.

          Procedure
            Step 1   From the DNA Center Home page, click > System Settings > Settings > SFTP.
            Step 2   Configure the SFTP settings as follows:

            • Host—IP address of the SFTP server.

            • Username—Name that is used to log into the SFTP server.

            • Password—Password that is used to log into the SFTP server.

            • Port—Port that is used to log into the SFTP server.

            • Root Location—Enter the location of the SFTP root directory.

            Step 3   Click Update.

            Configure SNMP Properties

            You can configure retry and timeout values for SNMP.

            Procedure
              Step 1   Click and select System Settings.
              Step 2   Click Settings > SNMP Properties.
              Step 3   Configure the following fields:
              Table 1 SNMP Properties

              Field

              Description

              Retries

              Number of attempts to connect to the device. Valid values are from 0-4. The default is 3.

              Timeout (in Seconds)

              Number of seconds DNA Center waits when trying to establish a connection with a device before timing out. Valid values are from 5-120 in intervals of 5 seconds. The default is 5.
              Step 4   Click Apply.
              Note   

              To return to the default settings, click Revert to Defaults.