Cisco ISE (Identity Services Engine)

TEHRAN, Dec. 08 (MNA) – Cisco Identity Services Engine or ISE is the industry-leading tool for ultimate visibility into every device on your network and gives you the control to build visibility-based segmentation to support a zero-trust framework.

The dramatic increase in BYOD devices, work from home and cloud applications has made obtaining visibility harder than ever. The Cisco ISE can be deployed on both physical Cisco’s SNS Server and virtual environments like VMware, KVM and Hyper-V. Cisco ISE architecture supports both standalone and distributed (also known as “high-availability” or “redundant”) deployments where one machine assumes the primary role and another “backup” machine assumes the secondary role.

Cisco ISE features distinct configurable personas, services, and roles, which allow you to create and apply Cisco ISE services where they are needed in the network. The result is a comprehensive Cisco ISE deployment that operates as a fully functional and integrated system. Also, Cisco ISE nodes can be deployed with one or more of the Administration (PAN), Monitoring (MnT), and Policy Service personas (PSN)

User authentication policies in Cisco ISE enable you to provide authentication for a number of user login session types using a variety of standard authentication protocols including, but not limited to, Password Authentication Protocol PAP, CHAP, PEAP, and EAP. Cisco ISE specifies the allowable protocol(s) that are available to the network devices on which the user tries to authenticate and specifies the identity sources from which user authentication is validated

To ensure that the imposed network security measures remain relevant and effective, Cisco ISE enables you to validate and maintain security capabilities on any client machine that accesses the protected network. By employing posture policies that are designed to ensure that the most up-to-date security settings or applications are available on client machines, the Cisco ISE administrator can ensure that any client machine that accesses the network meets

Now, Cisco ISE 3.0 makes all the experiences incredibly simpler, adds complete and dynamic visibility and enables cloud-first security. Approach visibility is the number one function of ISE giving you a detailed view into every device. You can get a snapshot of activity, unusual behavior, access denials and more all in a new easy to read graphic interface and to maintain visibility with the increase in BYOD and IoT devices coming on and off the network.

Cisco ISE Licensing

Basically, the Cisco ISE licensing has been changed during recent years. Till now, the Cisco license structure used in ISE version 2.x release was called the Lego model. In this model, there are three different license tiers: ISE Base license for user visibility and enforcement, ISE Plus license for context and ISE Apex license for compliance. So, it is called the Lego model because you can assemble your licenses as you need their associated features. The features you can use with one license, don't overlap with the features you can use with another license and you have to have a Base license to use Plus and or Apex license.

Cisco ISE (Identity Services Engine)

Since ISE 3.0, the most significant change is the hierarchy of the license tiers which is called the nested doll model. In this model, the higher tier license covers the lower tier license. So, you can use any features with ISE Essential license if you have ISE Advantage or ISE Premium license. Also, you can use any ISE features with an advantage license if you have a premier license

The new licensing structure is much simpler than the 2.x licensing model. For example, to fully use Cisco ISE functionality in ISE version 2.x you need three different licenses. But you need only one license in the 3.0 model. Another significant change is that Cisco ISE 3 licenses support only smart licensing. when a smart license token is active and registered in the Cisco ISE administration portal, the Cisco smart software manager or CSSM monitors the license consumption by each endpoint session or product license. So, you need your Cisco smart account registered in the CSSM and your ISE deployment needs to be continuously connected to the CSSM to monitor the license consumption. You can find the Cisco ISE license PIDs and features in the following figure.

Cisco ISE (Identity Services Engine)

However, in case that customers are not willing to connect their devices to the Internet and any inbound or outbound connection would violate their network security policies, they can use Cisco ISE PLR license or Cisco ISE Permanent License Reservation which enables all premier capabilities on the product permanently. This license also includes a device admin license and Cisco ISE virtual license

Moreover, all tier licenses including the essentials license are now time-based why the device admin license is still perpetual. Additionally, device admin licenses no longer need any tier licenses in 3.0 whereas it needs at least 100 base licenses in 2.x model

In general, the Essentials license equals the Base license, Advantage license is equivalent to Base and Plus licenses, and Premium license is identical to Base, Plus and Apex licenses.

This article is an advertisement and Mehr News Agency has no opinion on its content.

News Code 181550


Your Comment

You are replying to: .
  • captcha