Cisco Ise 13 User Guide

Step 4Deregisterthenodetobebackedup.
Step 5RestoretheMonitoringbackuptothenewlyderegisterednode.
Step 6RegisterthenewlyrestorednodewiththecurrentAdministrationnode.
Step 7PromotethenewlyrestoredandregisterednodeasthePAN.
Restore a Monitoring Backup with a Monitoring Persona
YoucanrestoreaMonitoringbackupinadistributedenvironmentwithonlyMonitoringpersona.
Before You Begin
•Purgetheoldmonitoringdata.
•Scheduleabackuporperformanon-demandbackup.
Procedure
Step...

Export Authentication and Authorization Policy Configuration
YoucanexportauthenticationandauthorizationpolicyconfigurationintheformofanXMLfilethatyoucan
readofflinetoidentifyanyconfigurationerrorsandusefortroubleshootingpurposes.ThisXMLfileincludes
authenticationandauthorizationpolicyrules,simpleandcompoundpolicyconditions,dACLs,andauthorization
profiles.YoucanchoosetoemailtheXMLfileorsaveittoyourlocalsystem.
Procedure
Step 1ChooseAdministration>System>Backup&Restore.
Step 2ClickPolicyExport.
Step...

Recovery of Lost Nodes Using Existing IP Addresses and Hostnames in a Distributed
Deployment
Scenario
Inadistributeddeployment,anaturaldisasterleadstoalossofallthenodes.Afterrecovery,youwanttouse
theexistingIPaddressesandhostnames.
Forexample,youhavetwonodes:N1(PrimaryPolicyAdministrationNodeorPrimaryPAN)andN2
(SecondaryPolicyAdministrationNodeorSecondaryPAN.)AbackupoftheN1node,whichwastakenat
timeT1,isavailable.Later,bothN1andN2nodesfailbecauseofanaturaldisaster.
Assumption...

2Youmustgenerateanewself-signedcertificate.
3YoumustlogintotheCiscoAdminportalonN1A,chooseAdministration>System>Deployment,
anddothefollowing:
DeletetheoldN2node.
RegisterthenewN2Anodeasasecondarynode.DatafromtheN1AnodewillbereplicatedtotheN2A
node.
Recovery of a Node Using Existing IP Address and Hostname in a Standalone Deployment
Scenario
Astandaloneadministrationnodeisdown.
Forexample,youhaveastandaloneadministrationnode,N1.AbackupoftheN1databasewastakenattime...

Configuration Rollback
Problem
Theremaybeinstanceswhereyouinadvertentlymakeconfigurationchangesthatyoulaterdeterminewere
incorrect.Forexample,youmaydeleteseveralNADsormodifysomeRADIUSattributesincorrectlyand
realizethisissueseveralhourslater.Inthiscase,youcanrevertbacktotheoriginalconfigurationbyrestoring
abackupthatwastakenbeforeyoumadethechanges.
Possible Causes
Therearetwonodes:N1(PrimaryPolicyAdministrationNodeorPrimaryPAN)andN2(SecondaryPolicy...

Forexample,youhavemultiplenodes:N1(PrimaryPAN),N2(SecondaryPAN),N3(SecondaryPolicy
ServiceNode),N4(SecondaryPolicyServiceNode).Oneofthesecondarynodes,N3,fails.
Resolution Steps
1ReimagethenewN3Anodetothedefaultstandalonestate.
2LogintotheN1AdminportalanddeletetheN3node.
3ReregistertheN3Anode.
DataisreplicatedfromN1toN3A.Norestoreisrequired.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
230
Recovery of Lost Nodes in Standalone and Distributed Deployments 

CHAPTER 13
Setup Endpoint Protection Service
•EnableEndpointProtectionServiceinCiscoISE,page231
•ConfigureNetworkAccessSettings,page231
•EndpointProtectionService,page233
•EPSQuarantineandUnquarantineFlow,page235
•EPSNASPortShutdownFlow,page236
•EndpointsPurgeSettings,page236
Enable Endpoint Protection Service in Cisco ISE
EndpointProtectionService(EPS)isdisabledbydefault.YoumustenableEPSmanually,anditremains
enableduntilyoumanuallydisabletheserviceintheAdminportal....

simultaneously.Ifyoudiscoverahostileendpointonyournetwork,youcanshutdowntheendpoint’saccess,
usingEPStoclosetheNASport.
Before You Begin
•YoumustenableEPS.
•YoumustcreateauthorizationprofilesandExceptiontypeauthorizationpoliciesforEPS.
Procedure
Step 1ChooseOperations>EndpointProtectionService.
Step 2UnderEndpointOperation,entertheIPAddressorMACAddressofanendpoint.
Step 3ClicktheOperationsdrop-downlisttochooseoneofthefollowingactions:
•Quarantine—Isolatestheendpoint,restrictingaccessonthenetwork...

BecauseCoArequiresaMACaddressorsessionID,werecommendthatyoudonotbouncetheportthat
isshownintheNetworkDeviceSNMPreport.
Note
Endpoint Protection Service
EndpointProtectionService(EPS)isaservicethatrunsontheAdministrationnodethatcanbeusedfor
monitoringandcontrollingnetworkaccessofendpoints.EPSisalsoknownasAdaptiveNetworkControl
(ANC).EPScanbeinvokedbytheISEadministratorontheadminGUIandalsothroughpxGridfromthird
partysystems.EPSsupportswiredandwirelessdeploymentsandrequiresaPlusLicense....

Procedure
Step 1ChoosePolicy>PolicyElements>Authorization>AuthorizationProfiles.
Step 2ClickAdd.
Step 3Enterauniquenameanddescriptionfortheauthorizationprofile,andleavetheAccessTypeas
ACCESS_ACCEPT.
Step 4ChecktheDACLNamecheckbox,andchooseDENY_ALL_TRAFFICfromthedrop-downlist.
Step 5ClickSubmit.
Create Exception Policies for Network Access through EPS
ForEPSauthorization,youmustcreateaquarantineexceptionpolicythatisprocessedbeforeallstandard...