Cisco Identity Services Engine Administrator Guide, Release 2.3

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Identity Services Engine Administrator Guide, Release 2.3

Chapter Title

Administer Cisco ISE

Results

Updated:
July 28, 2017

Chapter: Administer Cisco ISE

Administer Cisco ISE

Administrator Access Console

The following steps describe how to log in to the administrative portal.

Procedure

Step 1

Enter the Cisco ISE URL in the address bar of your browser (for example, https://<ise hostname or ip address>/admin/).

Step 2

Enter the username and case-sensitive password that were specified and configured during the initial Cisco ISE setup.
Step 3

Click Login or press Enter.

If your login is unsuccessful, click the Problem logging in? link in the log in window and follow the instructions that are displayed.

Administrator Lockout Because of Login Attempts

If you enter an incorrect password for your specified administrator user ID enough times, the Cisco ISE administration portal locks you out of the system and adds a log entry in the Server Administrator Logins report. Cisco ISE suspends the credentials for that administrator ID until you reset the password that is associated with the administrator ID, as described in the Chapter “Performing Post-Installation Tasks”of the Cisco Identity Services Engine Hardware Installation Guide. The number of failed attempts that is required to disable the administrator account is configurable according to the guidelines that are described in Section "User Account Custom Attributes and Password Policies". After an administrator user account gets locked out, an email is sent to the associated user.

Only an administrator with the role of Super Admin (including Microsoft Active Directory users) can configure the disable administrator access option.

Configure Proxy Settings in Cisco ISE

If your existing network topology requires you to use a proxy server to enable Cisco ISE to access external resources (such as the remote download site where you can find client provisioning and posture-related resources), use the administration portal to configure the proxy settings.

The proxy settings impact the following Cisco ISE functions:

  • Partner Mobile Management

  • Endpoint Profiler Feed Service Update

  • Endpoint Posture Update

  • Endpoint Posture Agent Resources Download

  • Certificate Revocation List (CRL) Download

  • Guest Notifications

  • SMS Message Transmission

  • Social Login

The Cisco ISE proxy configuration supports basic authentication for proxy servers. NT LAN Manager (NTLM) authentication is not supported.

Procedure

Step 1

Choose Administration > System > Settings > Proxy.

Step 2

Enter the proxy IP address or DNS-resolvable hostname, and specify the port through which proxy traffic travels to and from Cisco ISE in the Proxy host server : port field.

Step 3

Check the Password required check box, if necessary.

Step 4

Enter the username and password that are used to authenticate to the proxy servers in the User Name and Password fields. Reenter the password in the Confirm Password field.

Step 5

Enter the IP address or the address range of hosts or domains that must be bypassed in the Bypass proxy for these hosts and domain text box.

Step 6

Click Save.

Ports Used by the Administration Portal

The administration portal uses HTTP port 80 and HTTPS port 443 and you cannot change these settings. You cannot configure any of the end user portals to use these ports, to reduce the risk to the administration portal.

Enable External RESTful Services Application Programming Interface

The External RESTful Services application programming interfaces (API) are based on HTTPS protocols and REST methodology and use port 9060.

The External RESTful Services APIs support basic authentication. The authentication credentials are encrypted and are part of the request header.

You can use any REST client like JAVA, cURL Linux command, Python, or any other client to invoke External RESTful Services API calls.


Note

The ERS APIs support TLS 1.1 and TLS 1.2. ERS APIs do not support TLS 1.0 regardless of enabling TLS 1.0 in the Security Settings window (Administration > System > Settings > Security Settings). Enabling TLS 1.0 in the Security Settings window is related to the EAP protocol only and does not impact ERS APIs.

You must assign special privileges to a user to allow the user to perform operations using the External RESTful Services APIs. To perform operations using the External RESTful Services APIs (except for the Guest API), the user must be assigned to either ERS Admin or ERS Operatoradministrator group. The user must be authenticated against the credentials that are stored in the Cisco ISE internal database (internal admin users).

  • ERS Admin: This user can create, read, update, and delete External RESTful Services API requests. They have full access to all External RESTful Services APIs (GET, POST, DELETE, PUT).

  • ERS Operator: This user has read-only access (GET requests only).


Note

A user with the role Super Admin can access all External RESTful Services APIs.

ERS session idle timeout is 60 sec. If several requests are sent during this period, the same session is used with the same Cross-Site Request Forgery (CSRF) token. If the session has been idle for more than 60 sec, the session is reset and a new CSRF token is used.

The External RESTful Services APIs are disabled by default. If you evoke the External RESTful Services API calls before enabling them, you will receive an error response. Enable the Cisco ISE REST API feature for the applications developed for a Cisco ISE REST API to be able to access Cisco ISE. The Cisco REST APIs uses HTTPS port 9060, which is closed by default. If the Cisco ISE REST APIs are not enabled on the Cisco ISE administration server, the client application receives a timeout error from the server for any Guest REST API requests.

Procedure

Step 1

Choose Administration > System > Settings > ERS Settings.

Step 2

Click the Enable ERS for Read/Write radio button to enable External RESTful Services on the Primary Administration node (PAN).

Step 3

Click the Enable ERS for Read for All Other Nodes radio button if there are any secondary nodes in your deployment.

External RESTful Service requests of all types are valid only for primary Cisco ISE nodes. Secondary nodes have read-access (GET requests).

Step 4

In the CSRF Check area, click the radio button for one of the following options:

  • Use CSRF Check for Enhanced Security: If this option is enabled, the External RESTful Services client must send a GET request to fetch the CSRF token from Cisco ISE and include the CSRF token in the requests that are sent to Cisco ISE. Cisco ISE will validate a CSRF token when a request is received from the External RESTful Services client. Cisco ISE processes the request only if the token is valid. This option is not applicable for External RESTful Services clients earlier than Cisco ISE Release 2.3.

  • Disable CSRF for ERS Request: If this option is enabled, CSRF validation is not performed. This option can be used for External RESTful Services clients earlier than Cisco ISE 2.3.

Step 5

Click Save.

All REST operations are audited and the logs are logged in the system logs. External RESTful Services APIs have a debug logging category, which you can enable from the debug logging window in the Cisco ISE GUI.

When you disable External RESTful Services in Cisco ISE, port 9060 remains open but no communication is allowed through the port.

External RESTful Services Software Development Kit

Use the External RESTful Services (ERS) software development kit (SDK) to build your own tools. You can access the External RESTful Services SDK with the URL https://<ISE-ADMIN-NODE>:9060/ers/sdk. Only users with the role ERS Admin can access the External RESTful Services SDK.

The SDK consists of the following components:

  • Quick reference API documentation.

  • A complete list of all available API operations.

  • Schema files available for download.

  • Sample application in Java available for download.

  • Use cases in cURL script format.

  • Use cases in Python script format.

  • Instructions on using Chrome Postman.

Specify System Time and Network Time Protocol Server Settings

Cisco ISE allows you to configure up to three NTP servers. Use the NTP servers to maintain accurate time and synchronize time across different timezones. You can also specify whether Cisco ISE must use only authenticated NTP servers and enter one or more authentication keys for that purpose.

We recommend that you set all Cisco ISE nodes to the Coordinated Universal Time (UTC) timezone, especially if your Cisco ISE nodes are installed in a distributed deployment. This procedure ensures that the timestamps of the reports and logs from the various nodes in your deployment are always synchronized.

Cisco ISE supports public key authentication for NTP servers. NTP Version 4 uses symmetric key cryptography and also provides a new Autokey security model that is based on public key cryptography. Public-key cryptography is considered to be more secure than symmetric key cryptography. This is because the security is based on a private value that is generated by each server and never revealed. With the Autokey security model, all key distribution and management functions involve only public values, which considerably simplify key distribution and storage.

You can configure the Autokey security model for NTP server from the Cisco ISE CLI in Configuration Mode. We recommend that you use the Identification Friend or Foe (IFF) system as this system is most widely used.

Before you begin

You must have either the Super Admin or System Admin administrator role assigned.

If you have both primary and secondary Cisco ISE nodes in your deployment, you must log in to the user interface of each node and configure the system time and Network Time Protocol (NTP) server settings.

Procedure

Step 1

Choose Administration > System > Settings > System Time.

Step 2

In the NTP Server Configuration area, enter the unique IP addresses (IPv4 or IPv6 or fully qualified domain name (FQDN) value) for your NTP servers.

Step 3

Check the Only allow authenticated NTP servers check box to restrict Cisco ISE to use only authenticated NTP servers to keep system and network time.

Step 4

(Optional) To authenticate the NTP server using private keys, click the NTP Authentication Keys tab and specify one or more authentication keys if any of the servers that you specify require authentication via an authentication key. Carry out the following steps:

  1. Click Add.

  2. Enter the necessary values in the Key ID and Key Value fields. Specify whether the key in question is trusted by checking or unchecking the Trusted Key check box, and click OK. The Key ID field supports numeric values between 1 to 65535 and the Key Value field supports up to 15 alphanumeric characters.

  3. Click OK.

  4. Return to the NTP Server Configuration tab.

Step 5

(Optional) To authenticate the NTP server using public key authentication, configure the Autokey security model on Cisco ISE from the CLI. See the ntp server and crypto commands in the Cisco Identity Services Engine CLI Reference Guide for your Cisco ISE release.

Step 6

Click Save.

Change the System Time Zone

Once set, you cannot edit the time zone from the administration portal. To change the time zone setting, enter the following command in the Cisco ISE CLI:

clock timezone timezone

For more information about the clock timezone command, see Cisco Identity Services Engine CLI Reference Guide.


Note

Cisco ISE uses Portable Operating System Interface (POSIX)-style signs in the time zone names and the output abbreviations. Therefore, zones west of Greenwich have a positive sign and zones east of Greenwich have a negative sign. For example, TZ='Etc/GMT+4' corresponds to 4 hours behind Universal Time (UT).


Caution

When you change the time zone on a Cisco ISE appliance after installation, Cisco ISE services restart on that particular node. We recommend that you perform such changes within a maintenance window. Also, it is important to have all the nodes in a single Cisco ISE deployment that is configured to the same time zone. If you have Cisco ISE nodes located in different geographical locations or time zones, you should use a global time zone such as UTC on all the Cisco ISE nodes.

Configure SMTP Server to Support Notifications

Configure a Simple Mail Transfer Protocol (SMTP) server to send email notifications for alarms, to enable sponsors to send email notification to guests with their login credentials and password reset instructions, and to enable guests to automatically receive their login credentials after they successfully register themselves and with actions to take before their guest accounts expire.

Which ISE Nodes Send Email

The following list shows which node in a distributed ISE environment sends email.

Email Purpose

Node That Sends the Email

guest expiration

Primary PAN

alarms

Active MnT

sponsor and guest notifications from guest and sponsor portals

PSN

password expirations

Primary PAN

Procedure

Step 1

Choose Administration > System > Settings > SMTP Server.

Step 2

Choose Settings > SMTP Server.

Step 3

Enter the hostname of the outbound SMTP server in the SMTP server field. This SMTP host server must be accessible from the Cisco ISE server. The maximum length for this field is 60 characters.

Step 4

Choose one of these options:

  • Use email address from Sponsor to send guest notification email from the email address of the sponsor and choose Enable Notifications.

  • Use the default email address to specify a specific email address from which to send all guest notifications and enter it in the Default email addressfield.

Step 5

Click Save.

The recipient of alarm notifications can be any internal admin users with the Include system alarms in emails option enabled. The sender’s email address for sending alarm notifications is hardcoded as ise@<hostname>.

Cisco ISE Deployment Upgrade

Cisco ISE offers a GUI-based centralized upgrade from the administration portal. The progress of the upgrade and the status of the nodes are displayed in the Cisco ISE GUI. For information on the preupgrade and postupgrade tasks you must carry out, see the Cisco Identity Services Engine Upgrade Guide for the Cisco ISE release that you want to upgrade to.

The upgrade Overview window (Administration > System > Upgrade > Overview lists all the nodes in your deployment, the personas that are enabled on them, the Cisco ISE version that is currently in use, and the status (whether a node is active or inactive) of each node. You can begin upgrade only if all the nodes are in the Active state.

Different Types of Deployment

  • Standalone Node—A single Cisco ISE node assuming the Administration, Policy Service, and Monitoring persona.

  • Multi-Node Deployment—A distributed deployment with several ISE nodes. The procedure to upgrade a distributed deployment is discussed in the following listed references.

ISE Community Resource

For information on how to assess the network for ISE deployment readiness, see ISE Deployment Assistant (IDA).

Upgrade a Distributed Deployment

You can upgrade all the nodes in a Cisco ISE deployment using the Admin portal from Release 2.0 onwards, you can also upgrade a Limited Availability Release of Cisco ISE 2.0 or later to the General Availability Release.

Before you begin

Ensure that you have read the instructions in the section.

Procedure

Step 1

Click the Upgrade tab in the Admin portal.

Step 2
Step 3

Click Proceed.

The Review Checklist window appears. Read the given instructions carefully.

Step 4

Check the I have reviewed the checklist check box, and click Continue.

The Download Bundle to Nodes window appears.

Step 5

Download the upgrade bundle from the repository to the nodes:

  1. Check the check box next to the nodes to which you want to download the upgrade bundle.

  2. Click Download.

    The Select Repository and Bundle window appears.

  3. Select the repository.

    You can select the same repository or different repositories on different nodes, but you must select the same upgrade bundle on all the nodes.

    Figure 1. Upgrade Window Showing the Repositories Selected for Each Node

  4. Check the check box next to the bundle that you want to use for the upgrade.

  5. Click Confirm.

    Once the bundle is downloaded to the node, the node status changes to Ready for Upgrade.

Step 6

Click Continue.

The Upgrade Nodes window appears.

Figure 2. Upgrade Window Showing the Current Deployment and the New Deployment


Step 7

Choose the upgrade sequence.

When you move a node to the new deployment, a time estimate for the upgrade is displayed on the Upgrade Nodes window. You can use this information to plan for upgrade and minimize downtime. Use the sequence given below if you have a pair of Administration and Monitoring Nodes, and several Policy Service Nodes.

  1. By default, the Secondary Administration Node is listed first in the upgrade sequence. After upgrade, this node becomes the Primary Administration Node in the new deployment.

  2. The Primary Monitoring Node is the next one in the sequence to be upgraded to the new deployment.

  3. Select the Policy Service Nodes and move them to the new deployment. You can alter the sequence in which the Policy Service Nodes are upgraded.

    You can upgrade the Policy Service Nodes in sequence or in parallel. You can select a set of Policy Service Nodes and upgrade them in parallel.

  4. Select the Secondary Monitoring Node and move it to the new deployment.

  5. Finally, select the Primary Administration Node and move it to the new deployment.

Step 8

Check the Continue with upgrade on failure check box if you want to continue with the upgrade even if the upgrade fails on any of the Policy Service Nodes in the upgrade sequence.

This option is not applicable for the Secondary Administration Node and the Primary Monitoring Node. If any one of these nodes fail, the upgrade process is rolled back. If any of the Policy Service Nodes fail, the Secondary Monitoring Node and the Primary Administration Node are not upgraded and remain in the old deployment.

Step 9

Click Upgrade to begin the deployment upgrade.

Figure 3. Upgrade Window Showing the Upgrade Progress


The upgrade progress is displayed for each node. On successful completion, the node status changes to Upgrade Complete.

Note 

When you upgrade a node from the Admin portal, if the status does not change for a long time (and remains at 80%), you can check the upgrade logs from the CLI or the status of the upgrade from the console. Log in to the CLI or view the console of the Cisco ISE node to view the progress of upgrade. You can use the show logging application command to view the upgrade-uibackend-cliconsole.log and upgrade-postosupgrade-yyyymmdd-xxxxxx.log.

You can view the following upgrade logs from the CLI using the show logging application command:

  • DB Data Upgrade Log

  • DB Schema Log

  • Post OS Upgrade Log

In case you get a warning message: The node has been reverted back to its pre-upgrade state , go to the Upgrade window, click the Details link. Address the issues that are listed in the Upgrade Failure Details window. After you fix all the issues, click Upgrade to reinitiate the upgrade.

Note 

If the posture data update process is running on the Primary Administration Node in the new deployment, you cannot register a node to the Primary Administration Node. You can either wait till the posture update process is over (which might take approximately 20 minutes) or disable the posture auto-update feature from the Updates window while upgrading or registering a node to the new deployment. The navigation path for this window is Administration > System > Settings > Posture > Updates.

Cisco ISE Software Patches

Cisco ISE software patches are always cumulative. Cisco ISE allows you to perform patch installation and rollback from CLI or GUI.

You can install patches on Cisco ISE servers in your deployment from the Primary PAN. To install a patch from the Primary PAN, you must download the patch from Cisco.com to the system that runs your client browser.

If you are installing the patch from the GUI, the patch is automatically installed on the Primary PAN first. The system then installs the patch on the other nodes in the deployment in the order listed in the GUI. You cannot control the order in which the nodes are updated. You can also manually install, roll back, and view patch version. To do this, choose Administrator > System > Maintenance > Patch management window in the GUI.

If you are installing the patch from the CLI, you can control the order in which the nodes are updated. However, we recommend that you install the patch on the Primary PAN first.

If you want to validate the patch on some of the nodes before upgrading the entire deployment, you can use the CLI to install the patch on selected nodes. Use the following CLI command to install the patch:
patch install <patch_bundle> <repository_that_stores_patch_file>

For more information, see the "install Patch" section in the "Cisco ISE CLI Commands in EXEC Mode" chapter in Cisco Identity Services Engine CLI Reference Guide.

You can install the required patch version directly. For example, if you are currently using Cisco ISE 2.x and would like to install Cisco ISE 2.x patch 5, you can directly install Cisco ISE 2.x patch 5, without installing the previous patches (in this example, Cisco ISE 2.x patches 1 – 4). To view the patch version in the CLI, use the following CLI command:
show version

Software Patch Installation Guidelines

When you install a patch on an ISE node, the node is rebooted after the installation is complete. You might have to wait for a few minutes before you can log in again. You can schedule patch installations during a maintenance window to avoid temporary outage.

Ensure that you install patches that are applicable for the Cisco ISE version that is deployed in your network. Cisco ISE reports any mismatch in versions as well as any errors in the patch file.

You cannot install a patch with a version that is lower than the patch that is currently installed on Cisco ISE. Similarly, you cannot roll back changes of a lower-version patch if a higher version is currently installed on Cisco ISE. For example, if patch 3 is installed on your Cisco ISE servers, you cannot install or roll back patch 1 or 2.

When you install a patch from the Primary PAN that is part of a distributed deployment, Cisco ISE installs the patch on the primary node and then all the secondary nodes in the deployment. If the patch installation is successful on the Primary PAN, Cisco ISE then continues patch installation on the secondary nodes. If it fails on the Primary PAN, the installation does not proceed to the secondary nodes. However, if the installation fails on any of the secondary nodes for any reason, it still continues with the next secondary node in your deployment.

When you install a patch from the Primary PAN that is part of a two-node deployment, Cisco installs the patch on the primary node and then on the secondary node. If the patch installation is successful on the Primary PAN, Cisco then continues patch installation on the secondary node. If it fails on the Primary PAN, the installation does not proceed to the secondary node.

Install a Software Patch

Before you begin

  • You must have the Super Admin or System Admin administrator role assigned.

  • Go to Administration > System > Deployment > PAN Failover, and ensure that the Enable PAN Auto Failover check box is unchecked. The PAN auto-failover configuration must be disabled for the duration of this task.

Procedure

Step 1

Choose Administration > System > Maintenance > Patch Management > Install.

Step 2

Click Browse and choose the patch that you downloaded from Cisco.com.

Step 3

Click Install to install the patch.

After the patch is installed on the PAN, Cisco ISE logs you out and you have to wait for a few minutes before you can log in again.

Note 

When patch installation is in progress, Show Node Status is the only function that is accessible on the Patch Management page.

Step 4

Choose Administration > System > Maintenance > Patch Management to return to the Patch Installation page.

Step 5

Click the radio button next to the patch that you have installed on any secondary node and click Show Node Status to verify whether installation is complete.

What to do next

If you need to install the patch on one or more secondary nodes, ensure that the nodes are up and repeat the process to install the patch on the remaining nodes.

Roll Back Software Patches

When you roll back a patch from the PAN that is part of a deployment with multiple nodes, Cisco ISE rolls back the patch on the primary node and then all the secondary nodes in the deployment.

Before you begin

  • You must have either the Super Admin or System Admin administrator role assigned.

Procedure

Step 1

Choose Administration > System > Maintenance > Patch Management.

Step 2

Click the radio button for the patch version whose changes you want to roll back and click Rollback.

Note 

When a patch rollback is in progress, Show Node Status is the only function that is accessible on the Patch Management page.

After the patch is rolled back from the PAN, Cisco ISE logs you out and you have to wait a few minutes before you can log in again.

Step 3

After you log in, click the Alarms link at the bottom of the page to view the status of the rollback operation.

Step 4

To view the progress of the patch rollback, choose the patch in the Patch Management page and click Show Node Status.

Step 5

Click the radio button for the patch and click Show Node Status on a secondary node to ensure that the patch is rolled back from all the nodes in your deployment.

If the patch is not rolled back from any of the secondary nodes, ensure that the node is up and repeat the process to roll back the changes from the remaining nodes. Cisco ISE only rolls back the patch from the nodes that still have this version of the patch installed.

Software Patch Rollback Guidelines

To roll back a patch from Cisco ISE nodes in a deployment, you must first roll back the change from the PAN. If this is successful, the patch is then rolled back from the secondary nodes. If the rollback process fails on the PAN, the patches are not rolled back from the secondary nodes. However, if the patch rollback fails on any secondary node, it still continues to roll back the patch from the next secondary node in your deployment.

While Cisco ISE rolls back the patch from the secondary nodes, you can continue to perform other tasks from the PAN GUI. The secondary nodes will be restarted after the rollback.

View Patch Install and Rollback Changes

To view reports related to installed patches, perform the following steps.

Before you begin

You must have either the Super Admin or System Admin administrator role assigned. You can install or rollback patches choose Administration > System > Maintenance > Patch Management page. You can also view the status (installed/in-progress/not installed) of a particular patch on each node in the deployment, by selecting a specific patch and clicking the Show Node Status button.

Procedure

Step 1

Choose Operations > Reports > Audit > Operations Audit. By default, records for the last seven days are displayed.
Step 2

Click the Filter drop-down, and choose Quick Filter or Advanced Filter and use the required keyword, for example, patch install iniated, to generate a report containing the installed patches.

Federal Information Processing Standards Mode Support

Cisco ISE Federal Information Processing Standards (FIPS) 140 mode initializes the Cisco FIPS Object Module cryptographic module into FIPS 140 mode. Cisco ISE uses embedded FIPS 140 validated cryptographic modules. For details of the FIPS compliance claims, see FIPS Compliance Letter.

When the FIPS mode is enabled, the Cisco ISE administrator interface displays a FIPS mode icon at the left of the node name in the top-right corner of the window.

If Cisco ISE detects the use of a protocol or certificate that is not supported by the FIPS 140 standard, it displays a warning with the name of the protocol or certificate that is noncompliant, and the FIPS mode is not enabled. Ensure that you choose only FIPS-compliant protocols and replace non-FIPS compliant certificates before you enable the FIPS mode.

The FIPS standard places limitations on the use of certain algorithms. Cisco ISE enables FIPS 140 compliance via RADIUS shared secret and key management measures. When the FIPS mode is enabled, any function that uses non-FIPS-compliant algorithms fail.

The certificates that are installed in Cisco ISE must be re-issued if the encryption method that is used in the certificates is not supported by FIPS.

When you enable the FIPS mode, the following functions are affected:

  • IEEE 802.1X environment

    • EAP-Flexible Authentication via Secure Tunneling (EAP-FAST)

    • EAP-Transport Layer Security (EAP-TLS)

    • PEAP

    • RADIUS

  • Lightweight Directory Access Protocol (LDAP) over SSL

Cisco ISE enables FIPS 140 compliance via RADIUS shared secret and key management measures. When the FIPS mode is enabled, any function that uses a non-FIPS-compliant algorithm fails.

Once the FIPS Mode is enabled, all the nodes in the deployment are rebooted automatically. Cisco ISE performs a rolling restart by first restarting the primary PAN and then restarting each secondary node, one at a time. Hence, it is recommended that you plan for the downtime before changing the configuration.


Tip

We recommend that you do not enable FIPS mode before completing the database migration process.

Enable Federal Information Processing Standards Mode in Cisco ISE

To enable the FIPS mode in Cisco ISE:

Procedure

Step 1

Choose Administration > System > Settings > FIPS Mode.

Step 2

Choose Enabled from the FIPS Mode drop-down list.

Step 3

Click Save and restart your machine.

What to do next

After you enable FIPS mode, enable and configure the following FIPS 140 compliant functions:

You may want to enable administrator account authorization using a Common Access Card function. Although using Common Access Card functions for authorization is not strictly a FIPS 140 requirement, it is a well-known secure-access measure that is used in several environments to bolster FIPS 140 compliance.

Configure Cisco ISE for Administrator Common Access Card Authentication

Before you begin

  • (Optional) Enable the FIPS mode in Cisco ISE. FIPS mode is not required for certificate-based authentication, but the two security measures often go hand-in-hand. If you plan to deploy Cisco ISE in a FIPS 140 compliant deployment and use Common Access Card certificate-based authorization, enable the FIPS mode and specify the appropriate private keys and encryption/decryption settings first.

  • Ensure that the domain name server (DNS) in Cisco ISE is set for Active Directory.

  • Ensure that Active Directory user and user group memberships have been defined for each administrator certificate.

To ensure that Cisco ISE can authenticate and authorize an administrator based on the Common Access Card-based client certificate that is submitted from the browser, configure the following:

  • The external identity source (Active Directory in the following example).

  • The Active Directory user groups to which the administrator belongs.

  • How to find the user's identity in the certificate.

  • Active Directory user groups to Cisco ISE RBAC permissions mapping.

  • The Certificate Authority (trust) certificates that sign the client certificates.

  • A method to determine if a client certificate has been revoked by the certificate authority.

You can use a Common Access Card to authenticate credentials when logging in to Cisco ISE.

Procedure
Step 1

When you enable FIPS mode, you are prompted to restart your system. You can defer the restart if you are going to import certificate authority certificates as well.

Step 2

Configure an Active Directory identity source in Cisco ISE and join all Cisco ISE nodes to Active Directory.
Step 3

Configure a certificate authentication profile according to the guidelines.

Be sure to select the attribute in the certificate that contains the administrator username in the Principal Name X.509 Attribute field. For Common Access Cards, the Signature Certificate on the card is normally used to look up the user in Active Directory. The Principal Name is found in this certificate in the Subject Alternative Name extension, specifically in the Other Name area of the extension. So the attribute selection here should be Subject Alternative Name - Other Name.

If the Active Directory record for the user contains the user's certificate, and you want to compare the certificate that is received from the browser against the certificate in Active Directory, check the Binary Certificate Comparison check box, and select the Active Directory instance name that was specified earlier.

Step 4

Enable Active Directory for password-based administrator authentication. Choose the Active Directory instance name that you connected and joined to Cisco ISE earlier.

Note 

You must use password-based authentication until you complete other configurations. Then, you can change the authentication type to client certificate based at the end of this procedure.

Step 5

Create an external administrator group and map it to an Active Directory group. Choose Administration > System > Admin Access > Administrators > Admin Groups. Create an external system administrator group.

Step 6

Configure an administrator authorization policy to assign RBAC permissions to the external administrator groups.

Caution 

We strongly recommend that you create an external Super Admin group, map it to an Active Directory group, and configure an administrator authorization policy with Super Admin permissions (menu access and data access), and create at least one user in that Active Directory Group. This mapping ensures that at least one external administrator has Super Admin permissions once Client Certificate-Based Authentication is enabled. Failure to do this may lead to situations where the Cisco ISE administrator is locked out of critical functionality in the administration portal.

Step 7

Choose Administration > System > Certificates > Certificate Store to import certificate authority certificates into the Cisco ISE trusted certificates store.

Cisco ISE does not accept a client certificate unless the certificate authority certificates in the client certificate’s trust chain are placed in the Cisco ISE Certificates store. You must import the appropriate certificate authority certificates in to the Cisco ISE Certificates store.

  1. Click Browse to choose the certificate.

  2. Check the Trust for client authentication check box.

  3. Click Submit.

    Cisco ISE prompts you to restart all the nodes in the deployment after you import a certificate. You can defer the restart until you import all the certificates. However, after importing all the certificates, you must restart Cisco ISE before you proceed.

Step 8

Configure the certificate authority certificates for revocation status verification.

  1. Choose Administration > System > Certificates > OSCP Services.

  2. Click Add.

  3. Enter the name of an OSCP server, an optional description, and the URL of the server in the corresponding fields.

  4. Choose Administration > System > Certificates > Certificate Store.

  5. For each certificate authority certificate that can sign a client certificate, specify how to do the revocation status check for that certificate authority. Choose a certificate authority certificate from the list and click Edit. On the edit page, choose OCSP or certificate revocation list (CRL) validation, or both. If you choose OCSP, choose an OCSP service to use for that certificate authority. If you choose CRL, specify the CRL Distribution URL and other configuration parameters.

Step 9

Enable client certificate-based authentication. Choose Administration > System > Admin Access > Authentication.

  1. In the Authentication Method tab, click the Client Certificate Based radio button.

  2. Choose the certificate authentication profile that you configured earlier from the Certificate Authentication Profile drop-down list.

  3. Select the Active Directory instance name from the Identity Source drop-down list.

  4. Click Save.

    Here, you switch from password-based authentication to client certificate-based authentication. The certificate authentication profile that you configured earlier determines how the administrator’s certificate is authenticated. The administrator is authorized using the external identity source, which in this example is Active Directory.

    The Principal Name attribute from the certificate authentication profile is used to look up the administrator in Active Directory.
Supported Common Access Card Standards

Cisco ISE supports U.S. government users who authenticate themselves using Common Access Card authentication devices. A Common Access Card is an identification badge with an electronic chip containing a set of X.509 client certificates that identify a particular employee. Access via the Common Access Card requires a card reader into which you insert the card and enter a PIN. The certificates from the card are then transferred into the Windows certificate store, where they are available to applications such as the local browser running Cisco ISE.

Common Access Card Operation in Cisco ISE

You can configure the administration portal so that Cisco ISE authentications occur only through a client certificate. Credentials-based authentication that requires user IDs or passwords is not permitted. In client certificate-based authentication, you insert a Common Access Card card, enter a PIN, and then enter the Cisco ISE administration portal URL into the browser address field. The browser forwards the certificate to Cisco ISE, and Cisco ISE authenticates and authorizes your login session, based on the contents of the certificate. If this process is successful, the Cisco ISE Monitoring and Troubleshooting home page is displayed and you are given the appropriate RBAC permissions.

Secure SSH Key Exchange Using Diffie-Hellman Algorithm

Configure Cisco ISE to only allow Diffie-Hellman-Group14-SHA1 Secure Shell (SSH) key exchanges. Enter the following commands from the Cisco ISE CLI Configuration Mode:

service sshd key-exchange-algorithm diffie-hellman-group14-sha1

Here is an example:

ise/admin#conf t

ise/admin (config)#service sshd key-exchange-algorithm diffie-hellman-group14-sha1

Configure Cisco ISE to Send Secure Syslog

Before you begin

To configure Cisco ISE to send only TLS-protected secure syslog between the Cisco ISE nodes and to the monitoring nodes, perform the following tasks:

  • Ensure that all the Cisco ISE nodes in your deployment are configured with appropriate server certificates. For your setup to be FIPS 140 compliant, the certificate keys must have a key size of 2048 bits or greater.

  • Enable the FIPS mode in the administration portal.

  • Ensure that the default network access authentication policy does not allow any version of the SSL protocol. Use the TLS protocol in the FIPS mode along with FIPS-approved algorithms.

  • Ensure that all the nodes in your deployment are registered with the primary PAN. Also ensure that at least one node in your deployment has the Monitoring persona enabled on it to function as the secure syslog receiver (TLS server).

  • Check the supported RFC standards for syslogs. See Cisco Identity Services Engine Network Component Compatibility guide for your Cisco ISE release.

Procedure

Step 1

Configure a secure syslog remote logging target.
Step 2

Enable logging categories to send auditable events to the secure syslog remote logging target.

Step 3

Disable TCP Syslog and UDP syslog collectors. Only TLS-protected syslog collectors must be enabled.

Configure Secure Syslog Remote Logging Target

Cisco ISE system logs are collected and stored by log collectors for various purposes. To configure a secure syslog target, choose a Cisco ISE node with the Monitoring persona enabled on it as your log collector.

Procedure

Step 1

Log in to the Cisco ISE administration portal.

Step 2

Choose Administration > System > Logging > Remote Logging Targets.

Step 3

Click Add.

Step 4

Enter a name for the secure syslog server.
Step 5

Choose Secure Syslog from the Target Type drop-down list.

Step 6

Choose Enabled from the Status drop-down list.

Step 7

Enter the hostname or IP address of the Cisco ISE monitoring node in your deployment, in the Host / IP Address field.

Step 8

Enter 6514 as the port number in the Port field. The secure syslog receiver listens on TCP port 6514.

Step 9

Choose the syslog facility code from the Facility Code drop-down list. The default value is LOCAL6.

Step 10

Check the following check boxes to enable the corresponding configurations:

  1. Include Alarms For This Target

  2. Comply to RFC 3164

  3. Enable Server Identity Check
Step 11

Check the Buffer Messages When Server Down check box. If this option is checked, Cisco ISE stores the logs if the secure syslog receiver is unreachable, periodically checks the secure syslog receiver, and forwards the logs when the secure syslog receiver comes up.

  1. Enter the buffer size in the Buffer Size (MB) field.

  2. For Cisco ISE to periodically check the secure syslog receiver, enter the reconnect timeout value in the Reconnect Time (Sec) field. The timeout value is configured in seconds.

Step 12

Choose the CA certificate that Cisco ISE must present to the secure syslog server from the Select CA Certificate drop-down list.

Step 13

Ensure that the Ignore Server Certificate validation check box is not checked when configuring a Secure Syslog.

Step 14

Click Submit.

Enable Logging Categories to Send Auditable Events to the Secure Syslog Target

Enable logging categories for Cisco ISE to send auditable events to the secure syslog target.

Procedure

Step 1

Choose Administration > System > Logging > Logging Categories.

Step 2

Click the radio button next to the Administrative and Operational Audit logging category, then click Edit.

Step 3

Choose WARN from the Log Severity Level drop-down list.

Step 4

In the Targets area, move the secure syslog remote logging target that you created earlier to the Selected area.

Step 5

Click Save.

Step 6

Repeat this task to enable the following logging categories. Both these logging categories have INFO as the default log severity level and you cannot edit it.

  • AAA Audit.

  • Posture and Client Provisioning Audit.

Disable TCP Syslog and UDP Syslog Collectors

For Cisco ISE to send only secure syslog between the nodes, you must disable the TCP and UDP syslog collectors, and enable only Secure Syslog collectors.

Procedure

Step 1

Choose Administration > System > Logging > Remote Logging Targets.

Step 2

Click the radio button next to a TCP or UDP syslog collector.
Step 3

Click Edit.

Step 4

Choose Disabled from the Status drop-down list.

Step 5

Click Save.

Step 6

Repeat this process until you disable all the TCP or UDP syslog collectors.

Default Secure Syslog Collector

Cisco ISE provides default secure syslog collectors for the MnT nodes. By default, no logging categories are mapped to these default secure syslog collectors. The default secure syslog collectors are named as follows:

  • Primary MnT node: SecureSyslogCollector

  • Secondary MnT node: SecureSyslogCollector2

You can view this information on the Remote Logging Targets window (click the Menu icon () and choose Administration > System > Logging > Remote Logging Targets). You cannot delete the default syslog collectors and cannot update the following fields for the default syslog collectors:

  • Name

  • Target Type

  • IP/Host address

  • Port

During a fresh Cisco ISE installation, a certificate that is named Default Self-signed Server Certificate is added to the Trusted Certificates store. This certificate is marked for Trust for Client authentication and Syslog usage, making it available for secure syslog usage. While configuring your deployment or updating the certificates, you must assign relevant certificates to the secure syslog targets.

During a Cisco ISE upgrade, if there are any existing secure syslog targets pointing to MnT nodes on port 6514, the names and configurations of the target are retained. After the upgrade, you cannot delete these syslog targets and you cannot edit the following fields:

  • Name

  • Target Type

  • IP/Host address

  • Port

If no such targets exist at the time of upgrade, default secure syslog targets are created similar to the fresh installation scenario, without any certificate mapping. You can assign the relevant certificates to these syslog targets. If you try to map a secure syslog target that is not mapped to any certificate to a logging category, Cisco ISE displays the following message: 
Please configure the certificate for log_target_name

Offline Maintenance

If the maintenance time period is less than an hour, take the Cisco ISE node offline and perform the maintenance task. When you bring the node back online, the PAN node will automatically synchronize all the changes that happened during maintenance time period. If the changes are not synchronized automatically, you can manually synchronize it with the PAN.

If the maintenance time period is more than an hour, deregister the node at the time of maintenance and reregister the node when you add the node back to deployment.

We recommend that you schedule the maintenance at a time period during which the activity is low.


Note

  1. Data replication issues may occur if the queue contains more than 1,000,000 messages or if the Cisco ISE node is offline for more than six hours.

  2. If you are performing maintenance on the primary MnT node, we recommend that you take an operational backup of the MnT node before performing maintenance activities.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco