Community Tech-Talk: Introduction to Cisco Identity Services Engine (ISE)

Cisco Identity Services Engine

This tech-talk covers various aspects of Borderless Networks, which is on everyone's mind these days and various challenges involved in it. Cisco Identity Services Engine (ISE) is discussed including how it can ensure the security of networks.

As mentioned in the video, you can download the latest version of the Cisco Tech Support Mobile App (v3.2) by searching for "Cisco Technical Support" from within the iTunes, Google Play or BlackBerry App Stores.

[alainpannetier]

4 years later...
1. Companies use a lot of contractors or 3PP staff
2. Who are not on the LDAP/AD either as domain user or as domain computers
3. They must authenticate radius/like (PIP) through a captive-portal-like web page.
4. So there is at some point http response spoofing to redirect to the login page
5. so we are talking http, not https. Today browsers ignore https MITM attacks
6. ISE 1.x login page use SSL3 or best case scenarios TLSv1
7. Same thing, most recent browsers ignore the login page
8. Anyconnect uses https to get the config for the 3PP VPN group.
9. Again spoofing https or redirecting in TLSv1 is not working.

Conclusion. ISE ages very fast, users productivity is not increased but decreased. Admins tend to exempt 3PPs and contractors for that reason. The exact opposite of what should happen.

[bonnieabrahamvarghese]

My question is " Here, ISE needs to communicate with the device to understand about the device and then regulate its connection that it makes with the network. If so, what will happen if ISE cannot communicate with the device but it do can receive infomartion packets send by the device as per its functioning. In brief- can ISE analyse any data pack sent out by a device to learn more about it and then regulate its relation with the network" Hope my question is clear, and sorry if i confused the team.