Cisco ISE

Cisco ISE
Name	Cisco Identity Services Engine
Developer	Cisco Systems
Initial release	2011
Written in	Proprietary
Operating system	Linux-based appliance
License	Commercial

Cisco ISE

Cisco ISE is a network access control and policy management platform developed by Cisco Systems for identity-based network security and access governance. It provides centralized policy enforcement for wired, wireless, and virtual private network access across enterprise, campus, and data center environments. ISE integrates with authentication, authorization, accounting (AAA) infrastructures and third-party systems to deliver device profiling, posture assessment, and guest access capabilities.

Overview

Cisco ISE functions as an identity-aware policy engine that ties endpoint identities and contextual attributes to access decisions. It interoperates with directory services such as Microsoft Active Directory, LDAP, and RADIUS servers, and integrates with networking hardware from vendors like Cisco Systems and other manufacturers. Organizations ranging from enterprises to service providers deploy ISE to enforce role-based access for users and devices, often alongside products like Cisco Secure ACS, Cisco TrustSec, and Cisco Catalyst switches.

Architecture and Components

ISE is built as a modular appliance with distributed services: Policy Administration Node (PAN), Policy Service Node (PSN), and Monitoring and Troubleshooting Node (MnT). The PAN provides configuration and administration, the PSN handles authentication and authorization, and the MnT collects logs and reports. Components interoperate with identity stores such as Microsoft Active Directory, Okta, and Azure Active Directory, and with certificate authorities including DigiCert and Let's Encrypt. ISE supports profiling engines, posture assessment modules, and pxGrid for ecosystem integration with platforms like Splunk, Palo Alto Networks, Fortinet, VMware, and ServiceNow.

Deployment and Integration

Deployments vary from single-appliance proofs-of-concept to high-availability clusters spanning multiple data centers. ISE integrates with switching and wireless infrastructure from Cisco Catalyst, Cisco Nexus, Cisco Meraki, and third-party vendors through protocols like 802.1X, MAC authentication bypass (MAB), and VXLAN. It interfaces with security systems such as Cisco ASA, Firepower, Checkpoint, and Palo Alto Networks firewalls for enforcement actions. Integration patterns include on-premises, hybrid cloud, and multi-tenant service provider models, and ISE is often paired with identity providers like Okta, Ping Identity, and Azure AD.

Features and Functionality

ISE provides features including 802.1X authentication, RADIUS services, device profiling, posture assessment, guest management, and policy-based access control. Advanced capabilities include TrustSec group-based access control, downloadable user roles (DUR), and profiling that leverages attributes from endpoints and IoT devices. Monitoring and reporting features can export telemetry to analytics platforms like Splunk, Elastic Stack, and IBM QRadar. ISE also supports certificate-based authentication using protocols like EAP-TLS and integrates with certificate authorities and mobile device management systems such as MobileIron, Microsoft Intune, and VMware Workspace ONE.

Administration and Management

Administration is performed through a web-based Policy Administration Node GUI and CLI for appliance management. ISE provides role-based administration, configuration backup/restore, and node lifecycle management. It supports RESTful APIs and pxGrid for automation and orchestration with tools like Ansible, Puppet, Chef, and Terraform. Logging and monitoring integrate with observability platforms including Splunk, Prometheus, and Grafana for alerting and capacity planning.

Security and Compliance

ISE enforces identity-aware access controls that help meet compliance obligations for frameworks such as PCI DSS, HIPAA, and NIST SP 800-53. By correlating identity, posture, and contextual telemetry, ISE can quarantine or remediate non-compliant endpoints and work with remediation systems like Tanium and vulnerability scanners from Qualys and Rapid7. High-availability deployments and role-separation controls support operational security and auditability for regulated environments.

Licensing and Editions

Cisco offers ISE in multiple editions and licensing tiers that align features with customer needs, including base, plus, and apex or comparable named tiers for advanced services. Licensing models include perpetual and subscription options, device- or user-based licensing, and add-on licenses for features like profiling, BYOD, and guest portals. ISE is available as hardware appliances, virtual machine images for platforms like VMware ESXi and KVM, and as part of broader Cisco Secure offerings.

Category:Network security Category:Cisco products