{"type":"doc","content":[{"type":"paragraph","content":[{"text":"With the rapid growth of BYOD (Bring Your Own Device) trend, the complexity of securing network resources has become more challenging. To ensure data privacy and security of all network resources against threats, Infoblox introduces the ","type":"text"},{"text":"Ecosystem","type":"text","marks":[{"type":"strong"}]},{"text":" feature that allows you to expand the visibility of networks, users, and devices. Using this feature improves overall IT operations by sharing information between network and security teams.","type":"text"},{"type":"hardBreak"},{"text":"Integrating Cisco ISE server into NIOS enables NIOS and Cisco ISE to exchange valuable network, user, device, and security-event information, enriching both Infoblox DDI and Cisco ISE data. Cisco ISE is a centralized security solution (Network Access Control) that automates and enforces context-aware security access to network resources. This feature ensures that only the authorized users from legitimate devices get access to the services they need.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Note","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"NIOS does not support IPv6 communication with Cisco ISE.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Cisco ISE version 3.0 is only supported in NIOS version 8.6.2.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you want to use Cisco ISE version 3.1 (pxGrid 2.0), Infoblox recommends that you integrate using the Outbound endpoint. For more information about outbound endpoints, see ","type":"text"},{"text":"Configuring Outbound Endpoints","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721780895"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"When you configure a Cisco ISE, you can do the following:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Subscribe","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"to","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"contextual","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"data","type":"text","marks":[{"type":"strong"}]},{"text":": NIOS acts as a client to the Cisco ISE and collects information about the subscribed data types. You can configure extensible attributes without restricting them to specific object types, and then map these extensible attributes to Cisco ISE data to collect additional information. You can view subscribed information collected from the Cisco ISE in the appropriate tabs (","type":"text"},{"text":"IPAM","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text"},{"text":"IP","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Map","type":"text","marks":[{"type":"strong"}]},{"text":" panel, and ","type":"text"},{"text":"Network","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Users","type":"text","marks":[{"type":"strong"}]},{"text":") of the Infoblox GUI. For information about how to subscribe to contextual data, see ","type":"text"},{"text":"Configuring Cisco ISE on NIOS","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/722043088"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"}]},{"text":" You can also monitor subscription data using the ","type":"text"},{"text":"Subscription","type":"text","marks":[{"type":"strong"}]},{"text":" report. For information, see ","type":"text"},{"text":"Subscription Data","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/299109023"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Publish contextual data","type":"text","marks":[{"type":"strong"}]},{"text":" - You can publish contextual data from NIOS to specific Cisco ISE based on the conditions and criteria specified in the notification rules. To publish RPZ and threat protection notifications, you must first set up an external syslog server, as described in ","type":"text"},{"text":"Specifying Syslog Server for Notifications","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721846444"}}]},{"text":", .For more information about configuring notification rules, see ","type":"text"},{"text":"Configuring Notification Rules","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721846444"}}]},{"text":". You can monitor published data using the ","type":"text"},{"text":"Publish Data","type":"text","marks":[{"type":"strong"}]},{"text":" report through the Reporting and Analytics feature. For information, see ","type":"text"},{"text":"Publish data","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/299109023"}}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Supported Integrations","type":"text"}]},{"type":"paragraph","content":[{"text":"NIOS supports the integration of Cisco ISE versions 2.6 and 2.7, and 3.0.","type":"text"}]},{"type":"paragraph","content":[{"text":"Infoblox recommends that you use the Outbound endpoint for Cisco ISE integrations using Cisco pxGrid 2.0. For more information about outbound endpoints, see ","type":"text"},{"text":"Configuring Outbound Endpoints","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721780895"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Administrative Permissions","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, only superusers can add, edit, and delete Cisco ISEs. Limited-access admin groups can access Cisco ISEs only if their administrative permissions are defined. For information about administrative permissions, see ","type":"text"},{"text":"About Administrative Permissions","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/1010565123"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Prerequisites to Integrate Cisco ISE with NIOS","type":"text"}]},{"type":"paragraph","content":[{"text":"Do the following before you begin using this feature on NIOS:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You must install the ","type":"text"},{"text":"Security Ecosystem","type":"text","marks":[{"type":"strong"}]},{"text":" license to configure Cisco ISE. You might need the following licenses to configure notification rules for RPZ and threat protection event types: ","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

License	Event Types
RPZ	DNS RPZ
Threat Protection	Security ADP
DNS, DHCP, and MSMGMT	IPAM
DNS and DHCP	DHCP Lease

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"License","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Event","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Types","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"RPZ","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"DNS RPZ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Threat","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Protection","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Security ADP","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"DNS,","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"DHCP, and","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"MSMGMT","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"IPAM","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"DNS","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"and","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"DHCP","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"DHCP Lease","type":"text"}]}]}]}]}],"version":1},"reason":"A table in list item can't be created or edited in the new editor."}}}]},{"type":"paragraph","content":[{"text":"For information about how to install licenses, see ","type":"text"},{"text":"Managing Licenses","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/1103396983"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Cisco ISE uses SSL certificates as the method of authentication. You must upload the client certificate and client key when configuring the Cisco ISE server. You can include both client certificate and key in a single file and then upload. For information, see ","type":"text"},{"text":"Generating Certificates","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003300"}},{"type":"em"},{"type":"link","attrs":{"href":"#GeneratingCertificates"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#003300"}}]},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"Note to make sure to use the host name of the Grid member that is selected as the subscribing member. The host name of the subscribing member must match with the Common Name that you mention while generating the certificate.","type":"text"},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the bulk download certificate, download the server certificate from the monitoring node. If the admin node and monitoring node are on one node, then download the certificate from the admin node.","type":"text"},{"type":"hardBreak"},{"text":"Log into Cisco ISE and download the default self-signed server certificate (","type":"text"},{"text":"Administration","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"System","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"Certificates","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"Export","type":"text","marks":[{"type":"strong"}]},{"text":").","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the CA certificate, download the CA certificate from the admin node or the self-signed certificate (","type":"text"},{"text":"Administration","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"System","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"Certificates","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"Export","type":"text","marks":[{"type":"strong"}]},{"text":").","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Register NIOS as a client on the Cisco ISE. You must enable the ","type":"text"},{"text":"Auto-Registration","type":"text","marks":[{"type":"strong"}]},{"text":" option on the Cisco ISE: From the ","type":"text"},{"text":"Administration","type":"text","marks":[{"type":"strong"}]},{"text":" menu -> click ","type":"text"},{"text":"pxGrid Services","type":"text","marks":[{"type":"strong"}]},{"text":", and then click ","type":"text"},{"text":"Enable Auto-Registration","type":"text","marks":[{"type":"strong"}]},{"text":". For more information, refer to Cisco ISE documentation. When you register NIOS successfully, you can view infoblox_client_subscribe_xxxx and infoblox_client_publish_xxxx, where xxxx is a number generated based on the IP of the subscribing member on the Cisco ISE. If auto-registration is not enabled, approve the pxGrid client after registration. If you change the certificates, Cisco ISE may not register the client successfully. In this case, delete the related pxGrid client from the Cisco ISE server, which is automatically created again.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable the Identity Mapping feature on the NIOS appliance:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"From the ","type":"text"},{"text":"Grid","type":"text","marks":[{"type":"strong"}]},{"text":" tab, select the ","type":"text"},{"text":"Grid Manager","type":"text","marks":[{"type":"strong"}]},{"text":" tab -> ","type":"text"},{"text":"Grid Properties","type":"text","marks":[{"type":"strong"}]},{"text":" -> ","type":"text"},{"text":"Edit","type":"text","marks":[{"type":"strong"}]},{"text":" from the Toolbar.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Grid Properties Editor","type":"text","marks":[{"type":"em"}]},{"text":", select the ","type":"text"},{"text":"General","type":"text","marks":[{"type":"strong"}]},{"text":" tab -> ","type":"text"},{"text":"Advanced","type":"text","marks":[{"type":"strong"}]},{"text":" tab, select the ","type":"text"},{"text":"Enable network users feature","type":"text","marks":[{"type":"strong"}]},{"text":" checkbox.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To publish data:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To publish dynamic data, such as DHCP lease and IPAM information, make sure that you approve ","type":"text"},{"text":"Infoblox_DHCP","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"Infoblox_IPAM","type":"text","marks":[{"type":"strong"}]},{"text":" on the Cisco ISE, and then configure notification rules as described in ","type":"text"},{"text":"Configuring Notification Rules","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721846444"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To publish RPZ and threat protection notifications to the Cisco ISE server, you must first set up an external syslog server and then configure notification rules, as follows:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure an external syslog server that listens on port 2000, as described in ","type":"text"},{"text":"Specifying Syslog Server for Notifications","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721846444"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up notification rules, as described in ","type":"text"},{"text":"Configuring Notification Rules","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721846444"}}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":".","type":"text"}]}]}]}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Note","type":"text"}]},{"type":"paragraph","content":[{"text":"Refer to Cisco ISE documentation for information about how to perform auto-registration, creating authorized groups, and approving dynamic topics.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Limitations of Integrating Cisco ISE with NIOS","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Integrating Cisco ISE with NIOS has the following limitations:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You can publish IPAM data only from the Grid Master that is a subscribing member. A subscribing member is a Grid member that you want to subscribe as the client on the Cisco ISE. For more information, see ","type":"text"},{"text":"Publishing Data","type":"text","marks":[{"type":"textColor","attrs":{"color":"#0000ff"}},{"type":"em"},{"type":"link","attrs":{"href":"https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/721846444"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Only the subscribing member can publish its data to Cisco pxGrid.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the Grid Master is the subscribing member and you promote a Grid Master candidate to the Grid Master, then you have to create a client certificate for the promoted Grid Master.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"GeneratingCertificates"},"legacyAnchorId":{"value":"IntegratingCiscoISEintoNIOS-GeneratingCertificates"}},"macroMetadata":{"macroId":{"value":"f84e8f81f64811537e3bc3d5dd953215"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"0f2e1d2a-dc2d-41e7-8e09-231b32a0a11e"}},{"text":"Generating Certificates","type":"text"}]},{"type":"paragraph","content":[{"text":"To generate a self-signed key and certificate:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"openssl genrsa -out self1.key 4096","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"openssl req -new -key self1.key -out self1.csr","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"openssl req -x509 -days 365 -key self1.key -in self1.csr -out self1.cer","type":"text"}]}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"For CSR request:","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Country Name (2 letter code) [XX]: , for example: US","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"State or Province Name (full name) []: , for example: CA","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Locality Name (eg, city) [Default City]:, for example: SC","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Organization Name (eg, company) [Default Company Ltd]:, for example Infoblox","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Organizational Unit Name (eg, section) []:, for example: QA","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Common Name (eg, your name or your server's hostname) []:","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Email Address []:","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"Enter the following 'extra' attributes to be sent with your certificate request:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"A challenge password []:","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"Import the certificate generated in step 3 to Cisco ISE's trusted store. Select the ","type":"text"},{"text":"Trust for authentication within ISE","type":"text","marks":[{"type":"strong"}]},{"text":" checkbox.","type":"text"}]},{"type":"paragraph","content":[{"text":"Export the self-signed ISE certificate of the ISE server (under System -> Certificates). Make sure to select the","type":"text"},{"text":" pxGrid: Use certificate for the pxGrid Controller ","type":"text","marks":[{"type":"strong"}]},{"text":"checkbox before exporting it.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can call this as isemnt.cert","type":"text"}]},{"type":"paragraph","content":[{"text":"Wait for ISE services to restart. It may take a few minutes.","type":"text"}]}],"version":1}