Requirements for the Cisco ISE Cloud Central Agent

Updated: November 12, 2026

Want to summarize with AI?

Explains the requirements needed to successfully deploy the Cisco ISE Cloud Central Agent to integrate an on-premises Cisco ISE deployment to Cisco Cloud Control.

Refer to this topic to determine whether a Cisco ISE deployment and setup environment meet the requirements for Cisco Cloud Control integration using Cisco ISE Cloud Central Agent.

The table lists the requirements for installing and connecting the Agent successfully.

Table 1. Requirements for Cisco Cloud Control
Item	Description
Approved email address	Use the same email address for the Cisco products you plan to connect; ask each product administrator to grant access to that address if needed. For more information, see Getting Started Guide.
Access to ISE tenant	You have administrator access to the Cisco ISE tenant and any product tenants you want to connect. An administrator must be able to sign in to the product and accept the terms and conditions.
Region availabillity	Generally Available in the United States only. See Getting Started Guide

Table 2. Requirements for the Cisco ISE Cloud Central Agent
Item	Requirement
Cisco ISE Release	Use one of the following supported Cisco ISE releases and patches: Cisco ISE Releases 3.5 Patch 4, 3.4 Patch 7, and 3.3 Patch 12. Use a supported Cisco ISE server with a 64-bit x86 processor and application installation access. Note If you use Cisco ISE on AWS or Azure or OCI, apply Hotpatch of CSCwx12499 on top of Cisco ISE 3.3 Patch 12 before installing the Cisco ISE Cloud Central Agent. For patch details, refer to the Cisco ISE 3.3 software downloads.
Cisco ISE node and deployment type	Install the Cisco ISE Cloud Central Agent on the Primary Administration Node (PAN) of a supported Cisco ISE deployment.
Disk Space	Ensure that at least 4 GB of free disk space is available on your Cisco ISE appliance.
pxGrid	Enable pxGrid on the Cisco ISE node to receive real-time session updates. In Cisco ISE, choose Administration > pxGrid Services. Enable Allow password based account creation to create a pxGrid client.
ISE Administrator account	Use a Cisco ISE administrator account with either the Super Admin role or both the ERS Admin and MnT Admin roles to tether the Cisco ISE Cloud Central Agent. The installer prompts you for these credentials during setup.
ISE API settings	Before installing the agent, enable ERS API and OpenAPI at in Cisco ISE (in the Cisco ISE GUI, go to Administration > System > Settings > API Settings). The agent uses these APIs to access Cisco ISE configuration and operational data.
Cisco ISE Admin and pxGrid certificates	Use a valid Cisco ISE Admin certificate. As an administrator, your browser must trust the certificate's issuing chain. Use a complete public or enterprise trust chain and an FQDN present in the certificate SAN. For each Cisco ISE node that the agent connects to, use valid Admin and pxGrid certificates whose SAN includes the node’s FQDN as a DNS name. If a certificate is CA-signed, add its issuing CA certificates to the Cisco ISE Trusted Certificates store. For the Admin certificate, your browser must trust a complete public or enterprise issuing chain.
Cisco ISE Cloud Central Agent installation package	Download the latest Cisco ISE Cloud Central Agent installation package (`.tar.gz`) from Cisco Cloud Control. Keep the package’s original filename. Create a Cisco ISE repository on the PAN and copy the package to the repository. Note the repository name. You’ll need it during installation. Note For more information on creating repository, refer to Configure Repository on ISE.
Cisco ISE tethering token	Copy the Cisco ISE tethering token from Cisco Cloud Control. In the New Cisco Identity Services Engine (ISE) Integration page on Cisco Cloud Control, select Copy Tethering Token.
Internet access	Allow required outbound cloud connectivity. Configure an outbound proxy when needed; Cisco ISE is normally reached directly. The agent supports a proxy when direct internet access is unavailable.
CLI access	Ensure Cisco ISE CLI access over SSH.

Outbound connectivity requirements for the Cisco ISE Cloud Central Agent

The Cisco ISE Cloud Central Agent requires outbound TCP port 443 access to the following production destinations. An HTTPS proxy using CONNECT is supported for all three destinations.


Destination	Purpose
`ise-bootstrap.prod-us.cii.identityfabric.security.cisco.com`	Bootstrap during installation
`<prefix>-ats.iot.us-east-2.amazonaws.com`	AWS IoT Core connection using MQTT over TLS on port 443. Replace `<prefix>` with the provisioned hostname prefix.
`cnt-fabric-prod-us-data.s3.us-east-2.amazonaws.com`	Amazon S3 uploads, including large data batches and diagnostic logs

Exclude all three destinations from TLS inspection or SSL decryption. The AWS IoT Core connection uses client-certificate authentication and Amazon’s root CA; TLS inspection can break the connection.

Note

Use the provisioned <prefix>-ats.iot.us-east-2.amazonaws.com hostname for AWS IoT Core. The pattern *.ats.iot.us-east-2.amazonaws.com does not match this hostname because -ats is part of the first label.

Large batches of 512 KiB or more, batches of 1,000 items or more, and diagnostic log uploads go directly to pre-signed Amazon S3 URLs. S3 access is required for these uploads.

For production, use ise-bootstrap.prod-us.cii.identityfabric.security.cisco.com. The ise-bootstrap.staging.cii.identityfabric.security.cisco.com hostname is for staging. Do not use the broader *.cii.identityfabric.security.cisco.com wildcard when the exact production bootstrap hostname is sufficient.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.