Elisity supports connectivity to Cisco Identity Services Engine (ISE) as a method to enrich device identity with the context ISE already holds: who authenticated, how they authenticated, which authorization profile ISE assigned, and what ISE profiled the device as. The Cisco ISE connector reads live session data, and optionally endpoint data, from ISE over pxGrid and adds it to devices in IdentityGraph, where the attributes can be used as Policy Group match criteria.
The integration is read-only. The connector runs from an Elisity Virtual Edge in your network; Cloud Control Center never connects to ISE directly. The Virtual Edge signs in to pxGrid with its own client identity, reads the current active sessions once, and then follows the updates that ISE pushes, so new sessions and disconnects appear on the device within seconds. After a restart or a network outage, the connector resumes on its own. Elisity changes nothing in ISE: its only footprint is its pxGrid client, which an ISE administrator approves.
ISE data enriches devices that Elisity already knows and is matched to them by MAC and IP address. The connector does not create devices. You can connect several independent ISE deployments to one tenant; each is configured and monitored separately.
Prerequisites
Cisco ISE
- Cisco ISE 3.5 with pxGrid enabled (a node running the pxGrid persona).
- A pxGrid client certificate for Elisity, generated in ISE in PEM format with its private key. Certificate authentication is recommended; pxGrid password authentication is also supported.
- An ISE administrator to approve the Elisity pxGrid client.
- The default pxGrid session permission for the Elisity client (sufficient for session data).
No ISE administrator account, and no access beyond pxGrid, is needed.
To read endpoint data (identity group, vendor, model, operating system and custom attributes), which is optional, the pxGrid policy must also allow the client group of the Elisity client to use the endpoint service, and the following ISE 3.5 profiler settings must be turned on:
- MFC Profiling and AI Rules
- Enable Endpoint Attributes to Topics
- Custom Attribute for Profiling Enforcement
- Profiler Forwarder Persistence Queue
Elisity
- An online Virtual Edge, or a Virtual Edge Group for failover, that can reach ISE.
- DNS resolution of the ISE node names from the Virtual Edge. If the names are not in DNS, map them in the connector's Host overrides.
- If Verify TLS certificate is selected (recommended), the Virtual Edge must trust the certificates presented by the ISE nodes.
Allow the following traffic from the Virtual Edge to ISE:
| Source | Destination | Protocol and Port |
|---|---|---|
| Virtual Edge | ISE pxGrid nodes | TCP 8910 |
| Virtual Edge | Every ISE node that ISE lists for the session, pub/sub and (if used) endpoint services | TCP 8910 |
Configure the Connector
In Cisco ISE
Step 1. Navigate to Administration > pxGrid Services > Client Management > Certificates > Generate pxGrid Certificates. Generate a certificate for Elisity in PEM format, including the private key, and download it.
Keep Automatically approve new certificate-based accounts turned off in ISE. The Elisity client then receives no data until an ISE administrator approves it in Step 5.
In Cloud Control Center
Step 2. Navigate to IdentityGraph > Connectors and click Add Connector. In the search box, enter Cisco, then click Configure on the Cisco ISE card.
Step 3. On the Required Configuration tab, complete the fields described below.
| Field | Description |
|---|---|
| Endpoint Name | A descriptive name for this ISE deployment. |
| Virtual Edge or Virtual Edge Group | The Virtual Edge, or Virtual Edge Group for failover, that connects to ISE. |
| pxGrid hosts | The fully qualified domain names (FQDNs) of the ISE pxGrid nodes, separated by commas. |
| pxGrid client name | The name under which the Elisity client registers with pxGrid. This is the client the ISE administrator approves in Step 5. |
| pxGrid authentication | Select Client certificate (recommended) to authenticate with the certificate generated in Step 1, or Password (selected by default) to use pxGrid password authentication. |
| Client certificate (PEM) | Paste the certificate generated in Step 1, or click Upload PEM File. |
| Client private key (PEM) | Paste the private key that belongs to the certificate, or click Upload PEM File. When editing an existing connector, leave the field empty to keep the stored key. |
| pxGrid password | Shown when Password is selected. The pxGrid password for the client. |
| Endpoint data (identity group, vendor, model, OS, custom attributes) | Select to read ISE endpoint data in addition to sessions. Cleared by default. Requires the endpoint data settings in ISE listed under Prerequisites. |
| Host overrides | Optional. Maps an ISE hostname to an IP address when the Virtual Edge cannot resolve it in DNS. Enter the Hostname (FQDN) and IP address, and click Add Host Override for each additional node. |
| Verify TLS certificate | Select to have the Virtual Edge validate the certificates of the ISE nodes. Selected by default. Keep it selected in production; clear it only in a lab. |
| Description | Optional description of the connector. |
Optionally, configure the settings on the Advanced Settings tab, described in Advanced Settings.
Step 4. Click Add. The setup checks run immediately from the Virtual Edge. Until the client is approved, the pxGrid client account approved in ISE check shows Waiting and names the place in ISE to approve it.
In Cisco ISE
Step 5. Navigate to Administration > pxGrid Services > Client Management > Clients. Select the Elisity client, which shows as Pending, and click Approve. The client status changes to Enabled.
In Cloud Control Center
Step 6. In IdentityGraph > Connectors, expand the Cisco ISE row, click More Actions for the endpoint and select Edit Endpoint. When every setup check shows OK, the connector status reads Live updates from ISE over pxGrid, and the confirmation banner shows that sessions (and endpoints, if endpoint data is on) are being read.
To connect another independent ISE deployment, repeat these steps for that deployment.
Advanced Settings
The Cisco ISE connector has two groups of optional settings: per-endpoint settings that apply to one ISE deployment, and Global Settings that apply to every ISE deployment connected to the tenant.
Per-Endpoint Settings
The Advanced Settings tab is available when you add an endpoint and on the Edit Endpoint page.
| Setting | Default | Description |
|---|---|---|
| Query Exclusion Rules | Off | Devices that match an enabled rule are not enriched from this ISE deployment. Turn on Subnet and select the subnets, turn on Virtual Edge Node and select the Virtual Edge Nodes, or turn on Random MAC to exclude devices that use a randomized MAC address. |
| IP Only Based Lookup | Off | Select Enable IP Only Based Lookup to look a device up by IP address when no ISE record matches its MAC address. The connector does not use an IP address match when ISE reports that IP address on a different MAC address. |
Global Settings
Navigate to IdentityGraph > Connectors, click More Actions on the Cisco ISE connector row and select Global Settings. These settings apply to every ISE deployment connected to the tenant.
| Setting | Default | Description |
|---|---|---|
| Connector Data Purging | Off | Select Enable Connector Data Purging to remove the data learned from Cisco ISE about a device that is no longer found. Select a Time Period of 1 Day, 7 Days (preset), 30 Days or 90 Days. |
| Trusted Connector | Off | Sets enrichment from Cisco ISE to Trusted for Policy Groups and designates Cisco ISE as an authoritative identity source for Insights. |
Connector Status
The Edit Endpoint page shows the connector status (for example, Active), the time of the last update, and a Setup checks list. The status is Active when there are no problems, Degraded when there is a problem but ISE still returns session or endpoint data (and while the pxGrid client waits for approval in ISE), and Inactive when a blocking problem stops all data. The summary line next to Setup checks shows the overall result, for example All checks passed, and the time of the last check. The setup checks test each part of the integration from the Virtual Edge. They run when the connector is saved, when endpoint data is turned on or off, and periodically.
Each check shows one of the following statuses: OK, Waiting, Failed, or Not needed. A line that is not OK states what to fix. The following table describes each check.
| Check | What It Confirms | Where to Fix |
|---|---|---|
| Virtual Edge online and assigned | The selected Virtual Edge, or a member of the Virtual Edge Group, is online and assigned to the connector. | Edge Management > Virtual Edges in Cloud Control Center. |
| Virtual Edge reaches <node> on 8910 (DNS, TLS) | The Virtual Edge resolves the node name and completes a TCP and TLS connection on port 8910. One line appears for each pxGrid host. | DNS or the connector's Host overrides, firewall rules for TCP 8910, and trust of the ISE certificate. |
| pxGrid client account approved in ISE | An ISE administrator has approved the Elisity client. | In ISE: Administration > pxGrid Services > Client Management > Clients. |
| Session service offered and authorized | ISE offers the session service and allows the Elisity client to use it. | In ISE: Administration > System > Deployment, then the node's pxGrid settings. |
| Live session updates (pub/sub) subscribed | The Virtual Edge is subscribed to the session updates that ISE pushes. | In ISE: Administration > pxGrid Services > Settings. |
| Endpoint data service offered and authorized | ISE offers the endpoint service and allows the Elisity client to use it. Shows Not needed when endpoint data is turned off. | The pxGrid policy for the client group of the Elisity client, and the four ISE 3.5 profiler settings listed under Prerequisites. |
| Live push events arriving | Updates pushed by ISE are reaching the Virtual Edge. | Waiting is normal until a session changes in ISE. If the check stays Waiting, use Administration > pxGrid Services > Diagnostics in ISE. |
When several ISE deployments are connected, the connector summarizes how many of them need attention.
Using Cisco ISE Attributes in Policy Groups
Each device that ISE knows shows a Cisco ISE card in the Connectors area of the IdentityGraph tab on the Device Details page, and the Trust Attributes panel lists Cisco ISE under Known In.
| Field | Description |
|---|---|
| Profile | The endpoint profile ISE assigned to the device. |
| Type and Category | Type is the ISE profile as ISE sends it. Category is derived by Elisity from Type and Vendor, using the same rules Elisity applies to every source. |
| Identity Group, Vendor, Model, Switch Name | Values from ISE endpoint data. These appear only when endpoint data is turned on. |
| Auth Method and RADIUS Flow Type | How the device authenticated, for example 802.1X or MAC Authentication Bypass (MAB). |
| Authorization Profile | The authorization profile ISE assigned to the session. |
| Session State | The state of the ISE session, for example STARTED or DISCONNECTED. |
| User Name | The user that authenticated the session. For MAB sessions, ISE reports the device MAC address. |
| Switch IP | The IP address of the network device through which the session authenticated. |
| Last Seen | The time ISE last reported the device. |
| Matched on | How the ISE record was matched to the device, for example IP + MAC. |
| Status | Whether the ISE data on the device is current (Up to date) or expired (Stale). |
Cisco ISE also fills the device's Core Effective Attributes, such as Type, Category, Vendor, Model and Operating System, when no higher-ranked source provides them. The source of each value is shown next to it as (Cisco ISE).
Every Cisco ISE attribute is available as Policy Group match criteria. In the Criteria list, Cisco ISE attributes are labeled Cisco ISE. For example, a Policy Group with Category (Cisco ISE) Equals Collaboration and Authorization Profile (Cisco ISE) Equals a staging profile matches IP phones that ISE placed in staging.
Devices move between Policy Groups as the view ISE has of them changes, for example when ISE assigns a different authorization profile.
ISE does not report deleted endpoints or purged sessions. Elisity therefore expires the ISE data on a device 5 days (sessions only) or 7 days (with endpoint data) after ISE last sent it, and new data from ISE renews it. Expired data is marked Stale on the device and is removed only if Connector Data Purging is turned on in the connector's Global Settings. See Advanced Settings.