ISE High Level Design (HLD) (2024)

Contents

• Instructions
• Introduction
• Business Objectives
• Environment
• Network Architecture Diagram
• User Groups
• Network Devices
• Endpoints
• ISE Architecture
• Scenarios
• Device Administration (TACACS+)
• Visibility
• Secure Wireless
• Guest
• HotSpot
• Self-Registered
• Sponsored
• API
• BYOD
• Secure Wired
• VPN
• Segmentation
• Security Integrations
• Context Exchange
• Rapid Threat Containment (RTC)
• Threat-Centric NAC
• REST APIs
• Policy Details
• Resources

Instructions

1. Make a copy of this document
   

   For an offline or printed copy of this document, simply choose ⋮ Options > Printer Friendly Page. You may then Print, Print to PDF or copy and paste to any other document format you like.

2. Delete anything that does not pertain to your deployment
3. Fill in the rest with the appropriate details
4. Make it happen
5. Post any questions you have to the ISE Community

Introduction

An ISE High Level Design (HLD) is recommended to assist you with the design and planning of your ISE deployment. Having a clearly written security policy - whether aspirational or active - is the first step in assessing, planning and deploying network access security. Without this, it is hard to break down the deployment into phases by location or capabilities. When seeking outside help, the HLD provides a huge time savings for education other teams, partners, Cisco Sales representative, Technical Assistance Center (TAC) representative or even the ISE product and engineering teams. Clearly state the desired solution capabilities, hardware and software environment and integrations can quickly allow people to understand what you want and how to configure it or troubleshoot it.

Business Objectives

Identify the Customer Business Objectives that ISE must solve. Typically this involves regulations and compliance or identified security threats and risks to smooth operation of the business or brand. But it also involves mitigating risks with controlled network access for everyday IT processes. This is how you begin to craft your network access control policy. The more specific you can be, the better.

Consider the following example business objectives that must translate into access control policy :

• We want to provide sponsored guest access to our visitors
• All network device administration commands must be authorized and logged for potential audit
• We want to identify all endpoints on our network so we can begin to apply access control policies
• We do not want our employees personal devices on our corporate network
• We want our employees to any device they want but we want to manage it to ensure it and any information on it is properly secured
• Printers should only talk to print servers
• We need to be able to re-image our workstations over the network via PXE
• We must comply with [PCI, HIPAA, etc.] regulation
• All Windows devices must be patched within the last 30 days to minimize known vulnerabilities
• We want to automatically quarantine endpoints when [Stealthwatch, AMP, etc.] detects malicious behavior

Environment

Trust & Identity Services

List all of the products that ISE will need to integrate with for authoritative trust and identity for authentication and authorization. Please note any known issues or concerns with their behavior, capabilities or scale.

Note: Cisco strongly recommends server certificate, which is signed by in-house CA or other 3^rd party Root CA server, to be used for ISE. Self-signed server certificate should not be used for production deployment.

User Groups

Identify the specific user groups that will require differentiated access and for which scenarios.

Network Devices

Provide the general switch/controller model numbers/platforms deployed and Cisco IOS and AireOS Software versions to be deployed to support ISE design. Please use the ISE Compatibility Guides to see our latest list of Validated products and protocols. If you still don't believe that ISE supports heterogeneous networks and can support your network devices, please read Does ISE Support My Network Access Device?

Endpoints

List all of the unique endpoint types you expect to find and apply policy to in your deployment.

Provide an approximate number of each of possible.

Note: For domain joined Windows machines to function properly, machine authentication is recommended. Performing user only authentication may break critical functions such as machine GPO and other background services such as backup and software push.

Note: State whether the deployment is using machine or user authentication, or both. If both machine and user authentication are planned, are Machine Access Restrictions (MAR) planned? If so, review the Appendix information on MAR caveats. For machine / user authentication details, please refer to 802.1X Authenticated Wired and Wireless Access

ISE Architecture

List all of the nodes in your ISE deployment.

When deploying VMs:

• The VM host should be sized comparably with the ISE hardware appliance(s)
• The phyiscal RAM and CPU resources must be reserved for each ISE node and cannot be shared among different ISE nodes or other guest VMs on the VM host. If you cannot do this, please use physical appliances.
  
• Hard disks with 10K or higher RPM are required. Average IO Write performance for the disk should be higher than 300MB/sec and IO Write performance should be higher than 50MB/sec.
• For the MnT nodes, it is highly recommended to use SSD/Flash storage to greatly improve read/write performance

Scenarios

Device Administration (TACACS+)

Differentiated access for network device administrators

Visibility

See what, when, where and how users and endpoints are on your network.

In the table below, list the primary endpoint devices (one per row) that need to be profiled.

• Identify the primary device types to be profiled
• Which probes/protocols will be used to collect the required data? Leverage Device Sensor to collect endpoint attributes whenever possible and SNMP for other network devices. Uncommon devices may require collecting additional protocol attributes to classify the endpoint properly.
  • ISE Probes: AD, DHCP, DNS, HTTP, NMAP, RADIUS, SNMP, Netflow
  • Device Sensor: CDP, LLDP, DHCP, HTTP, H323, SIP, MDNS
  • AnyConnect: ACIDex
• What is the endpoint attribute data required to classify each device type?
• Is profiling for visibility only or for use in authorization policy?
• Leverage Device Sensor to collect endpoint attributes whenever possible and SNMP for other network devices
• Uncommon devices may require collecting additional protocol attributes to classify the endpoint properly.
• For Visibility with SPAN/RSPAN, use a dedicated interface on the ISE PSN for the DHCP SPAN or HTTP SPAN probe.
• If RSPAN or Netflow is to be used:
  • does infrastructure support these technologies?
  • a dedicated interface should be used on the Policy Service Node for the DHCP SPAN or HTTP SPAN probe. Is there sufficient bandwidth between source SPAN/Netflow exporter and ISE Policy Service node used for profiling?

Secure Wireless

Control authenticated endpoint & user access

Guest

Internet access for visitors. Generally, you should only implement one type of Guest network.

BYOD

Onboard & differentiate personal & corporate devices. Consider the following topics when determining your scenarios:

• Is it Single SSID or Dual SSID?
• Will Android be in the BYOD design? If so, please provide details of provisioning authorization profile
• What devices will and will not be provisioned?
• What supplicant will be used? Native or AnyConnect or Other?
• What access will unsupported device get? (i.e. Blackberry, Windows phones, Chromebooks)
• Will EMM/MDM be integrated with BYOD design? If so, please provide details of MDM policy below in the Authorization Policy section and whether or not redirection will be used for MDM agent installation

Secure Wired

Control authenticated endpoint & user access

VPN

Control remote access of endpoints and users.

Compliance & Posture

Ensure that endpoints meet security standards.

Review the list of currently supported packages for Windows and macOS.

Posture Policies

Describe posture policy requirements for endpoint compliance. This may include many areas such as asset checking, application and services checking, and antivirus and antispyware checks, as well as customized checks for specific use cases. Describe remediation plans and include remediation servers that need to be integrated into the design.

Client Provisioning Policies

Describe Client Provisioning policy requirements for posture and native supplicant provisioning.

Segmentation

Limit exposure with pre-defined access segmentation.

Security Integrations

Share contextual information with other products using Cisco Platform Exchange Grid (pxGrid) and REST APIs.

See the full list of technology partners at Cisco Security Technology Alliance.

Operations & Management

List the day-to-day operations you anticipate needing to do.

Scale & High Availability

List the scale and HA scenarios you want to test. See ISE Performance & Scale for detailed performance metrics.

Policy Details

List all security policies that are needed to implement the business requirements described above.

Authentication Policy

For each use case (wired, wireless, VPN), describe the authentication policies that will be implemented for all users and endpoints whether managed or unmanaged.

Authorization Policy

For each use case (wired, wireless, VPN), describe the authorization policies that will be implemented for all users and endpoints whether managed or unmanaged.

Resources

• ISE Performance & Scale