Cisco Identity Services Engine (ISE) 3.2 Patch2 发布

Cisco Identity Services Engine (ISE) 3.2 Patch2 发布 - 思科身份服务引擎

请访问原文链接：https://sysin.org/blog/cisco-ise-3/，查看最新版。原创作品，转载请保留出处。

作者主页：sysin.org

Cisco Identity Services Engine

工作场所零信任安全的核心所在

任何零信任策略的一个关键组成部分是确保所有人和所有设备所连接的办公环境的安全。思科身份服务引擎 (ISE) 支持动态和自动化的策略实施方法，可简化高度安全的网络访问控制服务的交付流程 (sysin)。ISE 支持软件定义接入，并自动化 IT 和 OT 环境中的网络分段。

阅读概览

为何选择思科使用案例案例研究服务合作伙伴专区

为什么要使用 ISE 来实现安全访问？

获得可视性、情景感知能力和可控性

了解正在连接终端和设备的用户、设备、位置以及连接方式。无论设备是否使用了代理，其都可以深入调查设备，以确保合规性并降低风险。
扩展零信任以遏制威胁

软件定义的网络分段可降低安全隐患，限制勒索软件的传播，并快速遏制威胁。
加速现有解决方案的价值转化之旅

与思科和第三方解决方案集成，在被动安全解决方案中引入主动保护功能，并提高投资回报率 (ROI)。
迈出安全访问的下一步

ISE 为 Cisco DNA Center 内的策略控制奠定了基础，是 SD-Access 的关键所在。
- 查看产品手册
- 观看演示

网络分段和可视性提供了可量化的 ROI

思科 ISE 提供简化的可扩展网络访问，有助于实现更强的安全态势。ISE 客户达成以下成果：

160 万美元

在三年内通过避免发生安全事件平均节省了 160 万美元

200 小时

修复重大网络安全事件所花费的时间平均减少了 200 小时

98%

实施网络更改的耗时平均缩短 98%

通向下一代安全网络访问解决方案的路径

通过提供满足当今数字化需求的功能，ISE 实现网络转型。

资产可视性动态可视性：及时了解最新的威胁，维护零信任办公场所。动态可视性：及时了解最新的威胁，维护零信任办公场所。

Network segmentation 网络分段：提高工作效率并减少安全隐患。网络分段：提高工作效率并减少安全隐患。

Threat containment 自动遏制威胁：此功能将消除威胁，而不仅仅是拦截威胁。自动遏制威胁：此功能将消除威胁，而不仅仅是拦截威胁。

Guest and secure wireless access 访客接入和安全无线接入：轻松激活并设置。访客接入和安全无线接入：轻松激活并设置。

Secure wired access 安全的有线访问：通过网络连接实施一致的策略。安全的有线访问：通过网络连接实施一致的策略。

Device compliance 设备合规性：查找并修复忽视安全策略的设备。设备合规性：查找并修复忽视安全策略的设备。

Security ecosystems integrations 与安全生态系统集成：提高现有解决方案的 ROI。与安全生态系统集成：提高现有解决方案的 ROI。

BYOD 自带设备 (BYOD)：用户客户使用他们想要的设备，无需担心安全问题。自带设备 (BYOD)：用户客户使用他们想要的设备，无需担心安全问题。

思科安全服务

借助思科安全服务，让 ISE 部署步入正轨。

查看服务

与我们联系

您可以通过我们与您的同行建立联系，并详细了解您感兴趣的安全主题。

思科 ISE 社区
思科 ISE YouTube 页面
安全博客
威胁研究博客
Talos 威胁情报

集成多种解决方案

思科 ISE 技术合作伙伴

通过情景数据和实施活动来改进操作和网络防御。

思科安全技术联盟

查看与思科安全产品集成的所有技术合作伙伴。

Cisco Platform Exchange Grid (pxGrid)

这个开放、可扩展且由 IETF 标准驱动的平台可助您实现安全防护自动化，从而更快地获取应答并遏制威胁。

选择很简单

安全选项企业协议 (EA) 从未如此灵活。它易于管理，可以帮助您更快地响应安全挑战。

深入了解

资源

产品手册和资料

产品手册公告案例研究概述生命周期终止和销售终止通知白皮书解决方案概述销售资源问题解答

了解部署方式

ISE 设备管理
ISE 访客和安全 Wi-Fi
ISE 资产可视性
ISE 自带设备 (BYOD)
ISE 安全有线接入
ISE 分段
ISE 合规性
ISE 集成
ISE 威胁遏制
思科 ISE 3.0 许可证常见问题解答
ISE 3.0 许可证迁移指南
观看演示
注册参加网络研讨会
什么是网络分段？

支持

技术支持
下载软件
ISE 入门

ISE 3.2 更新说明

Table: New and Changed Features in Cisco ISE Release 3.2

Feature	Description
Posture Condition Script Support	You can create and upload a posture condition script to check the compliance status of an endpoint. This feature is supported for Windows, macOS, and Linux platforms. See Add a Script Condition.
Cisco AnyConnect Rebranding	Cisco AnyConnect is rebranded as Cisco Secure Client. Cisco ISE 3.2 supports both the rebranded and legacy agents even though the Cisco ISE GUI is updated to use the rebranded terminology. See Compliance.
System 360	System 360 includes Monitoring and Log Analytics. The Monitoring feature enables you to monitor a wide range of application and system statistics, and key performance indicators (KPI) of all the nodes in a deployment from a centralized console. KPIs are useful to gain insight into the overall health of the node environment. Statistics offer a simplified representation of the system configurations and utilization-specific data. Cisco ISE 3.2 and later releases are integrated with Grafana and Prometheus. Grafana is a third-party metrics dashboard and graph editor. It provides a graphical or text-based representation of statistics and counters collected in the Prometheus database. Prometheus is used as the datastore to store the KPIs in time-series format. Log Analytics provides a flexible analytics system for in-depth analysis of endpoint authentication, authorization, and accounting (AAA) and posture syslog data. You can also analyze ISE health summary and ISE process statuses. Kibana, an open-source data visualization platform, is used to analyze and visualize the syslog data. Elasticsearch is used to store and index the syslog data. See System 360.
Mobile Device Management Enhancement	You can configure the General MDM or UEM Settings to query multiple MDM servers when the endpoints are not registered with the primary MDM or UEM server, or the primary MDM or UEM server is not reachable. See Configure General MDM or UEM Settings.
Open API Specification for ERS APIs	The Open API specification (JSON file) for ERS APIs is available for download in the Cisco ISE GUI, in the Overview section of the API Settings window (Administration > System > Settings > API Settings > Overview. This Open API JSON file can be used for auto-generation of API client code using any programming language such as Python, JAVA and so on. For additional information about Open API specifications and tools, see https://openapi.tools/. See Open API Specification for ERS APIs.
ERS APIs PATCH Request Support	Cisco ISE now supports PATCH request for ERS APIs. PATCH request helps in updating a subset of attributes for a resource. Only the attributes sent as part of the request are updated instead of updating the entire configuration for that resource. For more details, see API Reference Guide.
Single Entry for endpoints with GUID in the Endpoints context visibility window	In the Cisco ISE GUI, in the Context Visibility > Endpoints window, an endpoint with a GUID is listed only once with its latest random MAC address. See Single Entry for Endpoints with GUID in Endpoint Context Visibility Window.
View Cisco ISE in Default or Dark Mode	You can now view Cisco ISE in default (light) or dark mode. Choose the default or dark mode from the Account Settings dialog box in the Cisco ISE administrator portal. See Apply Default or Dark Mode in Cisco ISE.
EAP-TLS and TEAP Authentication with Azure Active Directory	Cisco ISE supports certificate-based authentication and Azure Active Directory authorization.You can select attributes from Azure Active Directory and add them to the Cisco ISE dictionary for use in authorization policies. See EAP-TLS and TEAP Authentication with Azure Active Directory
Managing Passwords of Cisco ISE Users	From Cisco ISE Release 3.2, as an internal user of Cisco ISE, you can manage the lifetime of your Enable and Login passwords using the Password Lifetime option. See Cisco ISE Users.
Cisco Private 5G	From Cisco ISE Release 3.2 onwards, Cisco ISE supports Cisco Private 5G and Session Management Function (SMF) software. Cisco ISE provides policy configuration for 5G authorization, that is implemented with RADIUS authorize-only and accounting flows. See Configure Cisco Private 5G as a service
Data Connect	The Data Connect feature provides database access to Cisco ISE using an Open Database Connectivity (ODBC) or Java Database Connectivity (JDBC) driver, so that you can directly query the database server to generate reports of your choice. Only read-only access to the data is provided. You can extract any configuration or operational data about your network depending on your business requirement and use it to generate insightful reports and dashboards. See Data Connect. Note If the Data Connect feature is active on your Cisco ISE Release 3.2 Limited Availability release, when you upgrade to the Cisco ISE Release 3.2 General Availability release you must disable and then enable the Data Connect feature.

Configuration of Authorization Policies for PassiveID Login Users	Check the Authorization Flow check box in the Active Directory Advanced Settings window if you want to configure authorization policies for PassiveID login users. You can configure an authorization policy to assign an SGT to a user based on the AD group membership. This allows you to create TrustSec policy rules even for PassiveID authorization. See Active Directory Settings.
Security Settings Enhancement	When the Allow SHA-1 Ciphers option (under Administration > System > Settings > Security Settings) is enabled, Cisco ISE allows SHA-1 ciphers for communication with the following Cisco ISE components: Admin Access UI Cisco ISE Portals ERS pxGrid This option is disabled by default. When you upgrade to Cisco ISE Release 3.2, the Allow SHA-1 Ciphers option is disabled even if you have enabled this option before the upgrade. You can enable this option after the upgrade if you want to allow the clients with only SHA-1 ciphers to communicate with Cisco ISE. You must restart all the nodes in a deployment after enabling or disabling this option. See Configure Security Settings.
Endpoint and Logical Profile Summary Report	This report lists the logical and endpoint profiles, and the number of endpoints matching those profiles. See Available Reports.
pxGrid Direct	Cisco pxGrid Direct helps you to connect to external REST APIs that provide JSON data for endpoint attributes. The data that are collected is based on the attributes your specify in your pxGrid Direct configurations. Then, pxGrid Direct stores the collected data in the Cisco ISE database. This data can be used in the authorization policies. pxGrid Direct helps to evaluate and authorize the endpoints faster as the fetched data is used in the authorization policies. This eliminates the need to query for endpoint attribute data each time an endpoint must be authorized. See Cisco pxGrid Direct.

下载地址

Cisco ISE Software Version 3.2 full installation.

This ISO file can be used for installing ISE on ISE-35x5 Appliances, SNS-36x5 Servers as well as a VM installation on VMware.

Filename: ise-3.2.0.542.SPA.x86_64.iso
Release date: 06-Sep-2022
Size: 13757.31 MB
MD5: d0eac7d11c60d8ba20dd41693f1725b5

Image	File Information	Release Date	Size
ise-3.2.0.542.SPA.x86_64.iso✅	Cisco ISE Software Version 3.2 full installation. This ISO file can be used for installing ISE on ISE-35x5 Appliances, SNS-36x5 Servers as well as a VM installation on VMWare	06-Sep-2022	13757.31 MB
ise-upgradebundle-2.7.x-3.1.x-to-3.2.0.542.SPA.x86_64.tar.gz✅	Upgrade bundle for upgrading ISE version 2.7, 3.0,3.1 to 3.2. This is a signed bundle for image integrity.	06-Sep-2022	15249.28 MB
ise-urtbundle-3.2.0.542-1.0.0.SPA.x86_64.tar.gz✅	Upgrade Readiness Tool (URT) to validate config DB upgrade from 2.7,3.0,3.1 to 3.2. This is a signed bundle for image integrity.	06-Sep-2022	964.17 MB
ISE-3.2.0.542-virtual-SNS3615-SNS3655-300.ova✅	ISE 3.2 OVA file - 300GB disk for Eval, Small, Medium (Recommend for Evaluation, PSN or PxGrid).	06-Sep-2022	21 GB
ISE-3.2.0.542-virtual-SNS3615-SNS3655-600.ova❌	ISE 3.2 OVA file - 600GB disk for Small or Medium (Recommend for PAN or MnT).	06-Sep-2022	21 GB
ISE-3.2.0.542-virtual-SNS3655-SNS3695-1200.ova	ISE 3.2 OVA file - 1200GB disk for Medium or Large (Recommend for PAN or MnT).	06-Sep-2022	21 GB
ISE-3.2.0.542-virtual-SNS3695-1800.ova❌	ISE 3.2 OVA file - 1800GB disk for Extra Large (Recommend for PAN or MnT).	06-Sep-2022	21 GB
ISE-3.2.0.542-virtual-SNS3695-2400.ova❌	ISE 3.2 OVA file - 2400GB disk for Extra Large (Recommend for PAN or MnT).	06-Sep-2022	21 GB