Now that Cisco has Finally Released the Identity Service Engine 2.0 (ISE) it seems only appropriate to call out some of the BEST things about it. Sitting in my hotel room, after an evening of Sake’ and war stories with the guys – what better thing to do then write a blog entry for you all to read and hopefully enjoy? At the time of this writing, Cisco’s ISE 2.0 has been in BETA is soon to be released to the public. This may be the single most anticipated release ever, so why not go through some of the cool things that are in it? Here’s my top 10 list. Some are big items, and some are just small little gems that I think everyone will love: 1. TACACS+ support for Device Administration AAA It’s no secret that I have been publicly vocal against adding device administration AAA to a product that is designed to be a Network Access AAA solution. If you had any doubts, just check out my RADIUS vs. TACACS blog entry from last year! It doesn’t seem to matter what my opinion was on the subject, the public demanded the addition of T+ to ISE, and they got it. What makes this the #1 cool feature of ISE 2.0 is the absolutely phenomenal job that Cisco has done fitting T+ into ISE. It’s been rock solid and is simply terrific for what some would expect to be a 1 dot oh feature. 2. The new Endpoints Identity page At first glance, this is a seemingly small thing, but this is the single most frequently viewed page in all of ISE. It was also one of the biggest pains to use. It was one of the first pages to be revamped in ISE 2.0, and it was revamped in a great way. Some very usable pie charts at the top also hold a small secret: click on the pie slices and it automatically filters the table below it. The table itself is completely re-written and remembers where you were when you click into an endpoint for details and then go back to the table. Aaron Woland Endpoint Identity Page 3. New Navigation Framework ISE is a complex system with tremendous power. A system like that cannot normally come with a User Interface that is contained within only a few pages. Most often a solution like this needs to have a menu system, and many levels of navigation. ISE is certainly afflicted with the need to have many menus with sub-levels and a simply put: a lot of navigation. That’s all well and good, but the GUI framework in ISE 1.0 was pretty painful. Incremental updates to the GUI have taken steps to speed up the experience, but were still just not fast enough for a modern day application. ISE 2.0 rips out the entire navigational framework and replaces it with one that is modern and lightening fast. It’s obviously the start of a complete UI overhaul – where some functional areas and their pages are also re-written, and I would expect that the entire UI refresh will be complete in the next release or two. The first time you log into ISE 2.0, you immediately see the difference with snappy “mega menus” and side navigation. Aaron Woland New Navigation 4. Upgrade Wizard It’s no secret that upgrade is a complex procedure for any large distributed system. Many solutions do not even offer an upgrade – instead they require you to reinstall and restore the configuration from backup. However, ISE has always supported upgrade and has made significant improvements with each release. ISE 2.0 adds a new Wizard-based GUI to handle the upgrades. You can specify which repository each node in the deployment should use, pre-stage the upgrade files, and control the order in which each node is upgraded. All within the GUI. Aaron Woland Upgrade Wizard 5. Support Tunnels Taken directly from the amazingly serviceable Cisco IronPort appliances, support tunnels have been added to ISE. For those who aren’t familiar with this feature on the IronPort appliances, it allows the admin to enable a secure tunnel for Cisco’s TAC to remotely access the appliance’s root operating system. Well, that’s the simple explanation. This is fantastic, because it means fewer WebEx sessions with Cisco TAC remotely seeing the UI of a customer’s ISE deployment – they can view it directly if and only if the customer has enabled the support tunnel & provided the TAC engineer with the unique key. 6. Stacking of Command Sets Along the lines of #1, which is the support of T+ for device administration AAA, ISE allows for multiple command sets to be sent in response to an authorization request. Brilliantly, the command sets will stack, where a permit statement shall always outweigh a deny statement – unless its a “deny_always” statement. Aaron Woland Stack Command Sets 7. Network Device Profiles Network Device Profiles are completely brilliant and provide something that some of us have been asking for in ISE since the very beginning, the ability to customize the settings for network devices, including the way it handles Change of Authorizations, URL-Redirections and more. The implementation of NAD profiles allows for them to be imported and exported so they can be shared. ISE 2.0 ships with a slew of pre-built profiles for many network devices, including Aruba, Alcatel, Brocade, and more. Aaron Woland NAD Profiles 8. Native EAP-TTLS Support EAP-TTLS is a tunneled EAP protocol that is fairly popular with universities that use eduroam. Prior to ISE version 2.0 it was one of the only popular EAP types that was missing support in ISE, even though there was support for it in Cisco’s supplicant: the Cisco AnyConnect Network Access Module. Aaron Woland EAP-TTLS 9. Certificate Provisioning Portal ISE 1.3 added the built-in Certificate Authority for BYOD endpoint certificates. It would create endpoint certificates for devices that underwent the Cisco BYOD on-boarding process only. In ISE 1.4 an API was added to allow the creation of priv/pub certificate key-pairs that could be imported into devices that couldn’t go through the BYOD flows. Now in ISE 2.0 there is a full-blown customizable portal that allows the creation of individual certificate key-pairs, submitting and signing Certificate Signing Requests (CSRs), or even the bulk creation of certificates. Aaron Woland Cert Portal 10. Kick Endpoints off Network when Certificate is Revoked When ISE issued the certificate to a BYOD endpoint, and that certificate was revoked, it would naturally be denied access at the next authentication. However the endpoint would remain on the network until the next re-authentication time. ISE 2.0 adds a CoA-Terminate (a disconnection) to any endpoint with an active session who’s certificate has been revoked, thereby immediately kicking them off the network. While this list of 10 is pretty cool, it is certainly not inclusive of all the great additions in ISE 2.0. It’s simply a small list of some nuggets that I thought I’d share. See you next time. Aaron Related content opinion How does certificate-based authentication work? The same cryptographic techniques that help ensure secure connections to websites also allow client devices to securely login to corporate networks By Aaron Woland May 10, 2021 11 mins Mobile Security Network Security Data Center opinion Securing the modern mobile OS Researchers from the Talos intelligence group recently published some research about a malicious MDM server pwning some mobile devices. In this blog post, we discuss how these mobile endpoints leverage MDMs and how the mobile OS is secured, so that t By Aaron Woland Jul 31, 2018 14 mins Small and Medium Business Mobile Device Management Mobile Security opinion Protecting iOS against the aLTEr attacks The new aLTEr attack can be used against nearly all LTE connected endpoints by intercepting traffic and redirecting it to malicious websites. This article summarizes how the attack works, and suggests ways to protect yourself from it – includin By Aaron Woland Jul 10, 2018 5 mins Small and Medium Business Mobile Security Network Security opinion A first-hand account of Cisco Live 2018 in Orlando The Cisco Live experience – from the perspective of a long-term attendee and speaker. A peak behind the curtain, learning Cisco technology, culture, education, beer and even kilts! See the options that are available to you through the eyes of By Aaron Woland Jun 21, 2018 14 mins Networking PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe