Cisco Ise 13 User Guide

•EndpointPostureAgentResourcesDownload
•CRL(CertificateRevocationList)Download
TheCiscoISEproxyconfigurationsupportsbasicauthenticationforproxyservers.NTLANManager(NTLM)
authenticationisnotsupported.
Procedure
Step 1ChooseAdministration>System>Settings>Proxy.
Step 2EntertheproxyIPaddressorDNS-resolvablehostmaneandspecifytheportthroughwhichproxytraffic
travelstoandfromCiscoISEinProxyhostserver:port.
Step 3CheckPasswordrequiredcheckbox,ifrequired.
Step...

RESTAPIinorderforapplicationsdevelopedforaCiscoISERESTAPItobeabletoaccessCiscoISE.The
CiscoRESTAPIsusesHTTPSport9060,whichisclosedbydefault.IftheCiscoISERESTAPIsarenot
enabledontheCiscoISEadminserver,theclientapplicationwillreceiveatime-outerrorfromtheserverfor
anyGuestRESTAPIrequest.
Procedure
Step 1ChooseAdministration>Settings>ERSSettings.
Step 2ChooseEnableERSforRead/WriteforthePrimaryAdministrationNode.
Step 3ChooseEnableERSforReadforAllOtherNodesifthereareanysecondarynodes....

CiscorecommendsthatyousetallCiscoISEnodestotheCoordinatedUniversalTime(UTC)
timezone—especiallyifyourCiscoISEnodesareinstalledinadistributeddeployment.Thisprocedureensures
thatthereportsandlogsfromthevariousnodesinyourdeploymentarealwaysinsyncwithregardtothe
timestamps.
Before You Begin
YoumusthaveeithertheSuperAdminorSystemAdminadministratorroleassigned.
IfyouhavebothaprimaryandasecondaryCiscoISEnode,youmustlogintotheuserinterfaceofthe...

ChangingthetimezoneonaCiscoapplianceafterinstallationrequiresservicestoberestartedonthat
particularnode.Hencewerecommendthatyouperformsuchchangeswithinamaintenancewindow.
Also,itisimportanttohaveallthenodesinasingledeploymentconfiguredtothesametimezone.Ifyou
havenodeslocatedindifferentgeographicallocationsortimezones,youshoulduseaglobaltimezone
suchasUTConallthenodes.
Caution
Formoreinformationontheclocktimezonecommand,refertotheCiscoIdentityServicesEngineCLI
ReferenceGuide.
Configure SMTP Server to...

Before You Begin
•YoumusthavetheSuperAdminorSystemAdminadministratorroleassigned.
Procedure
Step 1ChooseAdministration>System>Maintenance>PatchManagement>Install.
Step 2ClickBrowseandchoosethepatchthatyoudownloadedfromCisco.com.
Step 3ClickInstalltoinstallthepatch.
AfterthepatchisinstalledonthePAN,Ciscologsyououtandyouhavetowaitforafewminutesbeforeyou
canloginagain.
Whenpatchinstallationisinprogress,ShowNodeStatusistheonlyfunctionthatisaccessibleon
thePatchManagementpage.
Note
Step...

WhenyouinstallapatchfromthePrimaryPANthatispartofadistributeddeployment,CiscoISEinstalls
thepatchontheprimarynodeandthenallthesecondarynodesinthedeployment.Ifthepatchinstallationis
successfulonthePrimaryPAN,CiscoISEthencontinuespatchinstallationonthesecondarynodes.Ifitfails
onthePrimaryPAN,theinstallationdoesnotproceedtothesecondarynodes.However,iftheinstallation
failsonanyofthesecondarynodesforanyreason,itstillcontinueswiththenextsecondarynodeinyour...

thePAN,thepatchesarenotrolledbackfromthesecondarynodes.However,ifthepatchrollbackfailson
anysecondarynode,itstillcontinuestorollbackthepatchfromthenextsecondarynodeinyourdeployment.
WhileCiscoISErollsbackthepatchfromthesecondarynodes,youcancontinuetoperformothertasksfrom
thePANGUI.Thesecondarynodeswillberestartedaftertherollback.
View Patch Install and Rollback Changes
ThemonitoringandtroubleshootingcomponentofCiscoISEprovidesinformationonthepatchinstallation...

•TheCertificateAuthority(trust)certificatesthatsigntheclientcertificates
•AmethodtodetermineifaclientcertificatehasbeenrevokedbytheCA
YoucanuseaCommonAccessCard(CAC)toauthenticatecredentialswhenloggingintoCiscoISE.
Procedure
Step 1ConfigureanActiveDirectoryidentitysourceinCiscoISEandjoinallCiscoISEnodestoActiveDirectory.
Step 2Configureacertificateauthenticationprofileaccordingtotheguidelines.
BesuretoselecttheattributeinthecertificatethatcontainstheadministratorusernameinthePrincipalName...

d)ForeachCAcertificatethatcansignaclientcertificate,specifyhowtodotherevocationstatuscheckfor
thatCA.ChooseaCAcertificatefromthelistandclickEdit.Ontheeditpage,chooseOCSPand/orCRL
validation.IfyouchooseOCSP,chooseanOCSPservicetouseforthatCA.IfyouchooseCRL,specify
theCRLDistributionURLandotherconfigurationparameters.
Step 8Enableclientcertificate-basedauthentication.ChooseAdministration>System>AdminAccess>
Authentication.
a)ChooseClientCertificateBasedauthenticationtypeontheAuthenticationMethodtab....

Securing SSH Key Exchange Using Diffie-Hellman Algorithm
YoucanconfigureCiscoISEtoonlyallowDiffie-Hellman-Group14-SHA1SSHkeyexchanges.Todothis,
youmustenterthefollowingcommandsfromtheCiscoISECommand-LineInterface(CLI)Configuration
Mode:
servicesshdkey-exchange-algorithmdiffie-hellman-group14-sha1
Here’sanexample:
ise/admin#conft
ise/admin(config)#servicesshdkey-exchange-algorithmdiffie-hellman-group14-sha1
Configure Cisco ISE to Send Secure Syslog...