Asserting Cisco ISE 3.3 – Cisco Blogs


In case you have been at Cisco Stay in Las Vegas earlier this week you absolutely noticed that Cisco had a number of new merchandise to announce. Considered one of these new merchandise was the replace to Cisco Id Providers Engine (ISE 3.3).

Each community admin or safety operator has the identical difficulty: you’re attempting to reinforce your community’s safety, whereas including visibility and boosting effectivity, all with out sacrificing flexibility. In different phrases, you need extra options with out the issues. Cisco ISE 3.3 has that.

Cut up Improve and Multi-Issue Classification provides flexibility

Relating to flexibility, Cisco ISE 3.3’s Cut up Improve function will change the best way you take a look at ISE upgrades. Prospects might be hesitant to replace to the latest model of Cisco ISE, as a result of it might probably take a very long time for ISE nodes with giant databases to finish the improve. Cut up Upgrades is a brand new course of that’s much less complicated, as recordsdata are downloaded earlier than upgrades and prechecks are carried out. Cut up Improve provides you higher management on which ISE nodes to improve at any given time, with none downtime.

One other function in Cisco ISE 3.3 gives a option to simply determine clusters of unidentified endpoints discovered on the community. These endpoints are unidentified as a result of oftentimes quite a lot of endpoints connect with the community that aren’t straight provisioned by IT. This function makes use of AI/ML Profiling and multi-factor classification (MFC) to shortly determine clusters of an identical unknown endpoints through a cloud-based ML engine. From there, the units might be reviewed by proposed profiling insurance policies through the ML engine and have the units labeled as both MFC {Hardware} Producer, MFC {Hardware} Mannequin, MFC Working System and MFC Endpoint Kind.

By inserting the unidentified system into considered one of these 4 buckets, Cisco ISE has taken a giant chunk of guessing what goes the place out of the equation. From there it’s simpler for the shopper to find out what the endpoints are and what insurance policies ought to govern them when on the community.

Distinctive to Cisco: Wi-Fi Edge Analytics

A Cisco-only function known as Wi-Fi Edge Analytics will enable community admins to mine information from Apple, Intel and Samsung units to higher enhance profiling. Cisco Catalyst 9800 wi-fi controllers will move alongside endpoint-specific attributes, akin to mannequin, OS model, firmware, amongst others, to ISE through RADIUS. From there this data can be used to profile frequent endpoints discovered on the community. Community Admins will now have extra information permitting them to create extra outlined profiles. The extra data that’s on the fingertips of the admin, the extra exact the profile.

Even Extra Flexibility with Managed Utility Restart

To extend effectivity, predictability and scale back downtime, Cisco ISE 3.3 affords Managed Utility Restart. It advantages clients by saving them time and eliminating a number of the complications that include managing ISE admin certificates. Prospects are actually given the power to manage the substitute of the ISE administrative certificates permitting them the power to plan for upkeep as soon as their present certificates expires. Previous to this new function, a certification substitute required an entire reboot of all of the PSNs within the deployment with out the power to know or management the order to the reboot, which may trigger some admins to permit the certification to lapse.

Adjustments to certificates require a restart because it impacts systemwide configuration and can’t be carried out throughout operational hours because it requires important downtime. Nonetheless, Cisco ISE 3.3 now gives flexibility for these certifications to be scheduled the restart on the community admins’ comfort; in the course of the midnight or on weekend when community utilization is low. This eliminates the necessity for that downtime and helps to easy safety updates with out disruption.

Managed Utility Restart is a response to an trade pattern the place clients are shifting to a short-term certificates because of added safety. This new function is useful as the upkeep wanted to replace the certification—which may take upwards of half-hour per certificates—might be scheduled for the midnight, when community use is low, saving each time and sources.

Improved Insights with pxGrid Direct Visibility

pxGrid Direct Visibility has improved visibility from the final iteration of Cisco ISE (ISE 3.2) and now clients get improved endpoint attributes through exterior databases akin to Service Now. These attributes can now be proven in Context Visibility. Whether or not the information comes from endpoints, customers, units or which apps are working over the community and its totally different attributes, it gives a number of data such because the system kind, system proprietor and different issues like whether or not the system is operational.

Getting this endpoint information in an simply accessible style permits you to make higher community selections based mostly on details. This information can then be spun to run the community in a extra environment friendly method permitting for a safer community and fewer time spent on translating data.

More durable Safety with the TPM Chip

The brand new TPM Chip (for supported {hardware}) is a response to the necessity for elevated safety. Discovered on the brand new SNS-3700 fashions and in some digital environments (in a type of Digital TPM), the TPM chip is a devoted chip the place delicate data might be saved. Beforehand if Cisco ISE used a password to connect with a database, it was saved within the file system, which is much less safe. However now with the knowledge housed on the bodily TPM Chip, and with the power to create true random numbers for key technology, it has confirmed to be harder to entry thus offering a safer place for data to be saved.

With the variety of new options and performance that involves you with the newest Cisco ISE 3.3 replace, your community’s safety be enhanced, and you’ll discover a rise in effectivity and visibility.

Watch the Cisco ISE website for extra particulars on availability: https://www.cisco.com/web site/us/en/merchandise/safety/identity-services-engine/index.html

Share:

Leave a Reply

Your email address will not be published. Required fields are marked *