Cisco Identity Services Engine (ISE) - part 1

The main purpose of ISE is to 'Reduce The Attack Surface By Controlling Network Access’

 

• Cisco ISE profiles endpoints and identifies users. Based on contextual data collected, ISE creates role-based access (RBAC) policy.
• Cisco ISE uses Cisco TrustSec technology, embedded in Cisco routers and switching to enforce policy throughout the network.
• If an endpoint is compromised, ISE can be notified and change the access policy to contain or quarantine the threat

ISE is deployed as an appliance or runs on a virtual machine (VM). At the time of writing Cisco ISE has reached ver2.4.  In this post i will cover basic setup and integration with AD.

Basic Initialisation steps

Once the ISE VM is deployed you are presented with the following CLI prompt

 

For basic setup the following information will be required
Hostname, IP address, subnet mask, default gateway, domain name, NTP server, DNS server, SSH enablement, admin access credentials.

Once completed, https access will be possible via the management ip address.

At this point base policy configuration can be applied. Generally this will be local ISE users,  network device setup with shared secret between ISE and network device, AD authentication for centralised authentication, Identity Source Sequences for authorization, and ISE topology (standalone or distributed).

Add users

Admin->identities->add user

Admin->identities->groups->add group

Admin->identities->groups->add user to group

Add network devices

Admin - network resources - network devices - add {switch name}

Make ISE primary

Admin - deployment – {ise hostname} - make primary

Add AD authentication

Admin – external identity sources - active directory

Now test LDAP connection












 

Create Identity Source Sequence

Policy authentication - add new identity source sequence

Radius Vs Tacacs+

Radius is the main player for end point device authorisation and authentication for Network Access. It is an IETF standard for AAA. RADIUS is the transport protocol for Extensible Authentication Protocol (EAP), along with many other authentication protocols. With IEEE 802.1X, RADIUS is used to extend the layer-2 Extensible Authentication Protocol (EAP) from the end-user to the authentication server. Authentication and authorization are not separated in a RADIUS transaction. 

TACACS+ is commonly used for Device administration, even though RADIUS is capable of providing device administration AAA. Device administration can be interactive in nature, with the need to authenticate once, but authorize many times during a single administrative session in the command-line of a device:a router or switch may need to authorize a user’s activity on a per-command basis. TACACS+ is designed to accommodate this per command authorization need.



Cisco Identity Services Engine (ISE) has been updated in later versions (2.0 +) to support both Radius and Tacacs+. In upcoming posts i plan to dig into Cisco ISE.
 

Palo Alto Useful Commands

Management Interface Packet Capture
GUI packet capture can be used for packet capture of inline data interfaces.
To capture traffic on the management interface use cli tcpdump

tcpdump snpalen 0 filter "host a.b.c.d"
view-pcap mgmt-pcap mgmt.pcap
tftp export mgmt-pcap from mgmt.pcap to  {a.b.c.d}

less mp-log authd.log


 

Debug dataplane packet-diag clear all
debug dataplane packet-diag clear filter-marked-session all

Debug dataplane packet-diag set filter match destination 8.8.8.8

Debug dataplane packet-diag set filter on

Debug datapplane packet-diag show setting

Show counter  global filter packet-filter yes delta yes

 30 mins mod 3b

show session all filter source 192.168.17.50
show session all filter state
show session id {number}   even for aged out sessions