1. Introduction to Cisco Identity Services Engine (ISE)
Cisco Support Community Presents Tech-Talk
Introduction to Cisco Identity Services Engine (ISE)
With,
Gaurav Sharma
Software Engineer

2. Policy Evolving with Borderless Network
Anyone
The RIGHT Person
Any Device
Borderless Networks
An approved Device
Anywhere
In The Right Way
Anytime 2

3. ISE Concept & Evolution
Consolidated policy solution that will eventually replace the NAC / ACS products and will provide more features like MDM, BYOD and Trustsec.

4. Advantages of Identity Services Engine
Consolidated Services, Software Packages
Session Directory
Flexible Service Deployment
ACS
Access Rights
NAC Manager
User ID
ISE
Admin
Console
M&T
All-in-One HA Pair
NAC Profiler
NAC Server
NAC Guest
Location
Distributed PDPs
Device (& IP/MAC)
Simplify Deployment & Admin
Tracks Active Users & Devices
Optimize Where Services Run
Policy Extensibility
Manage Security Group Access
System-wide Monitoring & Troubleshooting
SGT
Public
Private
Staff
Permit
Permit
Guest
Permit
Deny
Consolidate Data, Three-Click Drill-In
Link in Policy Information Points
Keep Existing Logical Design

5. ISE Architectural Nodes / ISE Roles
PIP – Policy Information Point
Interface to retrieve policy or policy information
PAP – Policy Administration Point
Interface to configure policies
PDP – Policy Decision Point
Engine that makes policy decisions
PEP – Policy Enforcement Point
Interface that queries PDP and enforces policy
M&T – Monitoring and Troubleshooting
Interface for logging and report data

6. ISE Architecture M&T PAP PDP PIP Subject PEP Resource
Logging
Logging
View Logs/ Reports
PAP
PDP
PIP
View/ Configure Policies
Query Attributes
Request/Response Context
Logging
Subject
PEP
Resource
Access Request
Resource Access
PAP is the GUI to configure IES with distributed system capability like ACS replication feature
PIP like ACS today
PDP decision point
Network access (such as AAA RADIUS services)
Posture
Guest access
Profiling
Client Provisioning
PEP enforcement point (similar to inband NAC appliance) iPEP is a dedicated ISE role; an ISE node that is assigned the iPEP role cannot also be a PAP/PDP/M&T node at the same time.
M&T Component that provides Monitoring and Troubleshooting aswell include Collector function
© 2009, Cisco Systems, Inc. All rights reserved.
Presentation_ID.scr

7. LICENSES ??? Base Advanced Features 802.1X
User & device ID verification & authz
Guest management
Endpoint inventory ID reporting
Agent mgmt
Session directory
Broad Access
Internet
Quarantine
Guests
? Device
Profiling
Health compliance & remediation
Infection detection & cleanup
Device classification & anti-spoof
Security group access
Cisco Security Intelligence Ops
Device profiles
Health profiles
Infection detection
“What do I allow on my network?”
“Are my networked endpoints secure?”
Base
Advanced