Upload File

deploying cisco industrial network director (ind) with cisco ise … · 7 complete ind registration...

  • Home
  • Documents
  • Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the
13
Cisco Systems, Inc. www.cisco.com 1 Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid About this document This document is for Cisco Engineers and Customers deploying Cisco Industrial Network Director (IND) Release 1.3 or greater with Cisco Identity Services Engine (ISE) version 2.4 using pxGrid (Platform Exchange Grid). The reader should have some familiarity with ISE and IND and pxGrid. Cisco IND is registered with pxGrid as a publisher and publishes information on endpoint attributes to ISE for IOTASSET Dictionary. This document covers the registration process which involves importing a certificate from IND into ISE and also generating a self-signed certificate on ISE and then importing that certificate into IND. ISE features an Internal Certificate Authority(CA) for deploying pxGrid certificates. Technical Details Cisco IND is a Network Management tool for Industrial Networks which can detect Industrial endpoints such as PLC, HMI, I/O drives etc. IND also collects device attributes from these devices by communicating over Native protocols CIP, Profinet, Modbus etc. Cisco IND can register with ISE and push the device attributes for these Industrial endpoints using pxGrid. IND will be acting as a pxGrid publisher and ISE as a pxGrid subscriber Cisco IND pushes endpoint attributes such as assetID, assetDeviceType, assetMacAddress, assetIpAddress, assetProductID, assetProtocol, assetVendor, etc, and ISE subscribes to this information into “IOTASSET” Dictionary for the same attributes. ISE can use these attributes to Profile the Industrial endpoints based on Vendor, Type and location etc to apply Policies based on Organizational Security requirements. Importing/Generating Certificate from ISE to import on IND There are 2 methods to generate Certificate for ISE that needs to be imported into IND, first is using ISE Internal CA Authority and the second method is using External CA Authority, we will discuss both methods below.

Upload: others

Post on 21-May-2020

5 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Cisco Systems, Inc. www.cisco.com

1

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

AboutthisdocumentThis document is for Cisco Engineers and Customers deploying Cisco Industrial Network Director (IND) Release 1.3 or greater with Cisco Identity Services Engine (ISE) version 2.4 using pxGrid (Platform Exchange Grid). The reader should have some familiarity with ISE and IND and pxGrid.

Cisco IND is registered with pxGrid as a publisher and publishes information on endpoint attributes to ISE for IOTASSET Dictionary.

This document covers the registration process which involves importing a certificate from IND into ISE and also generating a self-signed certificate on ISE and then importing that certificate into IND. ISE features an Internal Certificate Authority(CA) for deploying pxGrid certificates.

TechnicalDetailsCisco IND is a Network Management tool for Industrial Networks which can detect Industrial endpoints such as PLC, HMI, I/O drives etc. IND also collects device attributes from these devices by communicating over Native protocols CIP, Profinet, Modbus etc.

Cisco IND can register with ISE and push the device attributes for these Industrial endpoints using pxGrid. IND will be acting as a pxGrid publisher and ISE as a pxGrid subscriber

Cisco IND pushes endpoint attributes such as assetID, assetDeviceType, assetMacAddress, assetIpAddress, assetProductID, assetProtocol, assetVendor, etc, and ISE subscribes to this information into “IOTASSET” Dictionary for the same attributes. ISE can use these attributes to Profile the Industrial endpoints based on Vendor, Type and location etc to apply Policies based on Organizational Security requirements.

Importing/GeneratingCertificatefromISEtoimportonINDThere are 2 methods to generate Certificate for ISE that needs to be imported into IND, first is using ISE Internal CA Authority and the second method is using External CA Authority, we will discuss both methods below.

Page 2: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

2

Method1:GeneratingCertificateusingISEInternalCAAuthorityNote: The Instructions below shows generating Certificate using PKCS12 format, we can also generate certificate in .PEM or .CER format and import on IND

GeneratingCertificateforISEthatcanbeimportedtopxGridclientssuchasINDetc

Step1SelectAdministration>pxGridServices>Certificatesandentertherelevantinformationasshownbelow

Step2ClickCreateStep3ClickOKtosavethe.zipfileandextractthecertificateontothelocaldrive

Method2:ImportCertificatefromISEusingExternalCAAuthorityNote: Only use this method if you are using External CA Authority.

Page 3: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

3

Step1.1OnISENavigatetothepageAdministration>System>Certificates>SystemCertificatesandselectthecertificatefromExternalCAandclickEdit.

Step1.2EnablepxGridonthiscertificatetobeusedbypxGridclientsbyselectingpxGridoptionandthenclickSaveasshownbelow.

Step1.3ExportthecertificatebyselectingthecertificateandclickExport.

Page 4: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

4

Step1.4EnterthePrivateKeyPasswordandClickExportforthecertificateandconfirmasshownbelow.

Step1.5SavethecertificatetobeusedinlaterstepstoimportintoIND.

DownloadingCertificatefromINDStep4OnINDUINavigatetothepageSettings>pxGridStep5ClickonDownload.pemINDCertificateasshownbelow

Step6Saveind.pemfiletothelocaldiskbyclickingonSaveFile

Page 5: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

5

ImportINDCertificateintoISE,thiscertificatewillallowISEtobulkdownloadassetinformationfromIND

Step7OnISE,NavigatetoAdministration>System>Certificates>CertificateManagement>TrustedCertificatesandclickImportasshownbelow

Step8ISEwillpromptyoutoimporttheCertificateintoCertificatestore

Page 6: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

6

Step9ClickBrowsetoselecttheind.pemfileonlocaldiskfromStep6,giveanametothecertificateandclickSubmittocompletetheimportofthecertificate.

Step10Importcompleted,seethelistforcertificatefromINDonISEasshownbelow

Page 7: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

7

CompleteINDRegistrationwithpxGrid

ImportCertificatefromISEtoIND

Step11OnINDUI,navigatetothepageSettings>pxGridandclick/slidethetoggletoenablepxGridashighlightedbelowinred.

Step12INDwillprompttoenterdetailsofISEserver.

Page 8: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

8

Step13IfthisisthefirsttimeyouareregisteringINDwithpxGrid,selectRegisteraNewNodeandenterISEserverdetailsandcertificatepasswordfromStep1asshownbelowandclickUploadCertificate.

Step14Windowpopsuptoselectthecertificate.

Page 9: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

9

Step15ClickBrowseandselectthecertificatefromlocaldisksavedinStep3.

Step16ClickUploadandRegisterasshownbelow.

Step17pxGridcertificateshouldberegisteredsuccessfullylookforbelowmessageandclickOK.

Page 10: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

10

ApproveINDRequestonISE

Step18OnISENavigatetoAdministration>pxGridServices>AllClients,youshouldseearequestforPendingApprovalasTotalPendingApproval(1)asshownbelow,ClickonTotalPendingApproval(1)toseeadropdownandclickonApproveAlltoapprovetherequestfromIND.

Step19ClickonApproveAllasshown.

Step20YoushouldseeINDonthelistofclientsasshownbelow

Page 11: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

11

ActivatepxGridonIND

Step21GobacktoINDandactivate,NavigatetoIND>Settings>pxGridandclickonActivateasshownbelow.

Step22pxGridbecomesactiveasshownbelow.

Step23CompletedpxGridregistrationandactivationonIND,pxGridpageonINDshouldlookasshownbelow.

Page 12: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

Technical Details

12

VerifyifINDissendingendpointattributestoISE

IfINDsenddeviceattributesyoushouldbeabletofindattributesonISEendpointattributesStep24OnISENavigatetoContextVisibility>Endpoints,selectandendpointandlookforattributesasshownbelow,thesearetheadditionalattributessuppliedbyINDforIndustrialendpointsandcanbeusedinISEProfilingpolicies.

Page 13: Deploying Cisco Industrial Network Director (IND) with Cisco ISE … · 7 Complete IND Registration with pxGrid Import Certificate from ISE to IND Step 11 On IND UI, navigate to the

Deploying Cisco Industrial Network Director (IND) with Cisco ISE using pxGrid

References

13

ReferencesCisco ISE Configuration guides

https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-and-configuration-guides-list.html

Cisco IND Configuration guides

https://www.cisco.com/c/en/us/support/cloud-systems-management/industrial-network-director/tsd-products-support-series-home.html

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

© 2018 Cisco Systems, Inc. All rights reserved.


Cisco ISE ポートリファレンス...Cisco ISE ポートリファレンス•CiscoISEインフラストラクチャ,1ページ •CiscoISE管理ノードのポート,3ページ

Cisco TrustSec How-To Guide: Cisco ISE Base … TrustSec How-To Guide: Cisco ISE Base Configuration and Bootstrapping For Comments, please email: [email protected] Current

Certificados TLS/SSL no ISE - Cisco

Cisco ISE Features · Cisco ISE Features Author Unknown Created Date 7/13/2020 2:13:38 PM ...File Size: 1MBPage Count: 10

Active Directory Integration with Cisco ISE 2.0

Cisco ISE Design and Architecture

DYNAMIC SEGMENTATION WITH CISCO ISE...In order to use User Roles with Cisco ISE, they must be defined locally on the switch. This document will cover Local User Roles with Cisco ISE

Configuring F5 LTM for Cisco ISE Load Balancing · Configuring F5 LTM for Load Balancing Cisco Identity Service Engine (ISE) Craig Hyps Principal Technical Marketing Engineer, Cisco

Cisco ISE 161115 SACisco ISE в управлении доступом к сети ... доступом к сети. ... Сервис posture в Cisco ISE Строительные блоки

Troubleshooting Cisco ISE

Inside Cisco IT: How Cisco Deployed ISE and …d2zmdbbm9feqrf.cloudfront.net/2017/eur/pdf/BRKCOC-2255.pdfHow Cisco Deployed ISE and TrustSec, globally ... Management Active Directory

Administer Cisco ISE€¦ · Administer Cisco ISE Author: Unknown Created Date: 3/19/2020 9:15:10 AM

Pre Deployment Checklist Cisco ISE

Set Up Cisco ISE in a Distributed Environment …

Troubleshooting the Cisco Secure ACS to Cisco ISE ......Title: Troubleshooting the Cisco Secure ACS to Cisco ISE Migration Tool Author: Unknown Created Date: 10/12/2017 5:04:31 PM

Cisco ISE for Campus Security

Cisco Identity Services Engine (ISE) Security Target · Cisco ISE ST January 2014 9 1.4.1 TOE Product Type The Cisco Identity Services Engine (ISE) v1.2 is a network device identity,

Cisco ISE в управлении доступом к сети...Конкурс “Cisco ISE в управлении доступом к сети” 22 декабря в 13:00 мск

クラウドを超えた Cisco ISEポリシーの拡張...Ciscoアイデンティティサービスエンジンの インテグレーション クラウドを超えた Cisco ISEポリシーの拡張

Cisco Identity Services Engine Network Component ... · Cisco ISE 2.4/Patch 5/Patch 10 Cisco ISE 2.6/Patch 2 Product Category Device Family Cisco ISE 3.0 Cisco ISE 2.7 Catalyst2960-S

Cisco SNS アプライアンスへの Cisco ISE ソフトウェアのイン …...6 Cisco SNS アプライアンスへの Cisco ISE ソフトウェアのインストール Cisco SNS

Cisco ISE Features · Cisco ISE Features • CiscoISEOverview,page2 • KeyFunctions,page2 • Identity-BasedNetworkAccess,page2 • SupportforMultipleDeploymentScenarios,page3

Network Deployments in Cisco ISE

TIBCO LogLogic® Log Management Intelligence (LMI) · Cisco ISE User Authentication Cisco ISE User Last Activity Cisco NXOS Permission Modification Cisco NXOS User Access Cisco NXOS

From Cisco ACS to ISE

Cisco ISE Integration with Mobile Device Management

Active Directory Integration with Cisco ISE 2 · Active Directory Integration with Cisco ISE 2.x ActiveDirectoryConfigurationinCiscoISE2.x 2 ActiveDirectoryKeyFeaturesinCiscoISE2.x

A4 Brochure Course Implementing and Configuring …...• Migrating Cisco ACS to ISE | Module 10 | Cisco ISE Design (Self-Study) • ISE planning and Pre-deployment • ISE sizing

Troubleshooting Cisco ISE...G-5 Cisco Identity Services Engine User Guide, Release 1.2 OL-26134-01 Appendix G Troubleshooting Cisco ISE Installation and Network Connection Issues Client

LogLogic Cisco ISE

(NE) BEZPEČNOST V TELEKOMUNIKAČNÍCH SÍTÍCH€¦ · • Cisco Firepower NGFW • Meraki MX • Cisco AMP • Cisco ISE • Cisco AnyConnect • Cisco Firepower NGIPS • Cisco

Cisco ISE for BYOD and Secure Unified Access

Cisco Identity Services Engine (ISE) - Cisco Systems, Inc

Cisco Identity Services Engine (ISE) Security Target · Cisco ISE ST January 2014 1 Cisco Identity Services Engine (ISE) Security Target Revision 1.0 January 2014

WEB REDIRECTION WITH CISCO ISEkd9cpb.com/wp-content/uploads/2020/11/ArubaOS-Switch_Web...Cisco ISE (2.3 And Above) OVERVIEW This document will cover Web Redirection with Cisco ISE