Introduction to Cisco Identity Services Engine (ISE) Cisco Support Community Presents Tech-Talk Introduction to Cisco Identity Services Engine (ISE) With, Gaurav Sharma Software Engineer

Policy Evolving with Borderless Network Anyone The RIGHT Person Any Device Borderless Networks An approved Device Anywhere In The Right Way Anytime 2

ISE Concept & Evolution Consolidated policy solution that will eventually replace the NAC / ACS products and will provide more features like MDM, BYOD and Trustsec.

Advantages of Identity Services Engine Consolidated Services, Software Packages Session Directory Flexible Service Deployment ACS Access Rights NAC Manager User ID ISE Admin Console M&T All-in-One HA Pair NAC Profiler NAC Server NAC Guest Location Distributed PDPs Device (& IP/MAC) Simplify Deployment & Admin Tracks Active Users & Devices Optimize Where Services Run Policy Extensibility Manage Security Group Access System-wide Monitoring & Troubleshooting SGT Public Private Staff Permit Permit Guest Permit Deny Consolidate Data, Three-Click Drill-In Link in Policy Information Points Keep Existing Logical Design

ISE Architectural Nodes / ISE Roles PIP – Policy Information Point Interface to retrieve policy or policy information PAP – Policy Administration Point Interface to configure policies PDP – Policy Decision Point Engine that makes policy decisions PEP – Policy Enforcement Point Interface that queries PDP and enforces policy M&T – Monitoring and Troubleshooting Interface for logging and report data

ISE Architecture M&T PAP PDP PIP Subject PEP Resource Logging Logging View Logs/ Reports PAP PDP PIP View/ Configure Policies Query Attributes Request/Response Context Logging Subject PEP Resource Access Request Resource Access PAP is the GUI to configure IES with distributed system capability like ACS replication feature PIP like ACS today PDP decision point Network access (such as AAA RADIUS services) Posture Guest access Profiling Client Provisioning PEP enforcement point (similar to inband NAC appliance) iPEP is a dedicated ISE role; an ISE node that is assigned the iPEP role cannot also be a PAP/PDP/M&T node at the same time. M&T Component that provides Monitoring and Troubleshooting aswell include Collector function © 2009, Cisco Systems, Inc. All rights reserved. Presentation_ID.scr

LICENSES ??? Base Advanced Features 802.1X User & device ID verification & authz Guest management Endpoint inventory ID reporting Agent mgmt Session directory Broad Access Internet Quarantine Guests ? Device Profiling Health compliance & remediation Infection detection & cleanup Device classification & anti-spoof Security group access Cisco Security Intelligence Ops Device profiles Health profiles Infection detection “What do I allow on my network?” “Are my networked endpoints secure?” Base Advanced