Cisco Ise 13 User Guide

NavigatetoAdministration>pxGridServices>LiveLogtoviewthelistofevents.Youcanalsoclearthe
logsandresynchronizeorrefreshthelist.
ISE  pxGrid  Identity Mapping
IdentityMappingenablesyoutomonitorusersthatareauthenticatedbyaDomainController(DC)andnot
byCiscoISE.InnetworkswhereCiscoISEdoesnotactivelyauthenticateusersfornetworkaccess,itis
possibletouseIdentityMappingtocollectuserauthenticationinformationfromtheactivedirectory(AD)...

Configuring Identity Mapping
IDMappingrequiresconfigurationinISE,andtheActiveDirectoryDomainServermusthavetheright
patchesandconfiguration.
Configure Identity Mapping
ISEmustbeabletoestablishaconnectionwithanADDomainController(DC).
Before You Begin
EnablepxGridservicestoconfigureIdentityMapping.ChooseAdministration>System>Deploymentto
enablepxGridservices.
ToaddanewDomainController(DC)forIdentityMapping,youneedthelogincredentialsofthatDC....

Filter Identity Mapping
Youcanfiltercertainusers,basedontheirnameorIPaddress.Youcanaddasmanyfiltersasneeded.The
“OR”logicoperatorappliesbetweenfilters.Ifboththefieldsarespecifiedinasinglefilter,the“AND”logic
operatorappliesbetweenthesefields.TheMonitoringlivesessionshowsIdentityMappingcomponentsthat
arenotfilteredoutbytheMappingFilters.
Procedure
Step 1ChooseAdministration>pxGridIdentityMapping>MappingFilters.
Step 2ClickAdd,entertheUsernameandorIPaddressoftheuseryouwanttofilterandclickSubmit.
Step...

AfteryouinstallandsetuptheInlinePostureapplication,youmustconfigurecertificatesbeforeyoucan
registertheInlinePosturenodes.SeetheCiscoIdentityServicesEngineHardwareInstallationGuideformore
information.
Register an Inline Posture Node
Werecommendthatyoudecideonthetypeofnode(CiscoISEorInlinePosture)atthetimeofregistration.
Ifyouwanttochangethenodetypelater,youhavetoderegisterthenodefromthedeployment,restartCisco
ISEonthestandalonenode,andthenreregisterit.
Before You Begin...

Synchronize Primary and Secondary Cisco ISE Nodes
YoucanmakeconfigurationchangestoCiscoISEonlythroughthePrimaryPAN.Theconfigurationchanges
getreplicatedtoallthesecondarynodes.If,forsomereason,thisreplicationdoesnotoccurproperly,you
canmanuallysynchronizetheSecondaryPANwiththePrimaryPAN.
Before You Begin
YoumustclicktheSyncupbuttontoforceafullreplicationiftheSyncStatusissettoOutofSyncorifthe
ReplicationStatusisFailedorDisabled.
Procedure
Step 1LogintothePrimaryPAN.
Step...

Effects of Modifying Nodes in Cisco ISE
WhenyoumakeanyofthefollowingchangestoanodeinaCiscoISEISE,thatnoderestarts,whichcauses
adelay:
•Registeranode(StandalonetoSecondary)
•Deregisteranode(SecondarytoStandalone)
•ChangeaprimarynodetoStandalone(ifnoothernodesareregisteredwithit;PrimarytoStandalone)
•PromoteanAdministrationnode(SecondarytoPrimary)
•Changethepersonas(whenyouassignorremovethePolicyServiceorMonitoringpersonafromanode)...

Afteryousavethenodegroup,itshouldappearinthenavigationpaneontheleft.Ifyoudonotseethenode
groupintheleftpane,itmaybehidden.ClicktheExpandbuttononthenavigationpanetoviewthehidden
objects.
What to Do Next
Addanodetoanodegroup.EditthenodebychoosingthenodegroupfromtheMemberofNodeGroup
drop-downlist.
Deploy pxGrid Node
YoucanenableCiscopxGridpersonabothonastandalonenodeanddistributeddeploymentnode.
Before You Begin
•YouneedaPluslicensetoenabletheCiscopxGridpersona....

•Configuremonitoringrolesandservicesonbothnodesandnamethemfortheirprimaryandsecondary
roles,asappropriate.
•ConfigurerepositoriesforbackupanddatapurgingonboththeprimaryandsecondaryMonitoringnodes.
Forthebackupandpurgingfeaturestoworkproperly,usethesamerepositoriesforboththenodes.
Purgingtakesplaceonboththeprimaryandsecondarynodesofaredundantpair.Forexample,ifthe
primaryMonitoringnodeusestworepositoriesforbackupandpurging,youmustspecifythesame
repositoriesforthesecondarynode....

Procedure
Step 1ChooseAdministration>System>Deployment.
Step 2Checkthecheckboxnexttothesecondarynodethatyouwanttoremove,andthenclickDeregister.
Step 3ClickOK.
Step 4VerifyreceiptofanalarmonyourPrimaryPANtoconfirmthatthesecondarynodeisderegisteredsuccessfully.
IfthesecondarynodefailstoderegisterfromthePrimaryPAN,thealarmisnotgenerated.
Change the Hostname or IP Address of a Standalone Cisco ISE Node
Youcanchangethehostname,IPaddress,ordomainnameofstandaloneCiscoISEnodes.Youcannotuse...

Procedure
Step 1Re-imageorre-installtheCiscoISEsoftwareonthenewnodes.
Step 2ObtainalicensewiththeUDIforthePrimaryandSecondaryPANsandinstallitonthePrimaryPAN.
Step 3RestorethebackuponthereplacedPrimaryPAN.
TherestorescriptwilltrytosyncthedataontheSecondaryPAN,buttheSecondaryPANisnowastandalone
nodeandthesyncwillfail.DataissettothetimethebackupwastakenonthePrimaryPAN.
Step 4RegisterthenewnodeasasecondaryserverwiththePrimaryPAN.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
54
Replace...