Cisco Identity Services Engine (ISE)

The nice thing about Cisco Identity Services Engine is it can be deployed as a multi node server deployment that can easily scale up or down depending on the load of the organization. Upgrading/patching is not an issue to business continuity as the multi server architecture allows the administrator to keep all services running while applying patches/upgrade during business hours.

As a BYOD controlling tool, Cisco Identity Services Engine can easily integrate with Cisco Wireless Controllers where administrators can easily manage the wireless user troubleshooting and identifying the authentication or network related issues such as DHCP. If Cisco Identity Services Engine is integrating with 3rd party devices, those devices must support industry standard specifications for radius and authentication protocols.

I would think for us, it's just really at scale. Once you get to a certain point, it's very difficult to do manual security. So the group policies, again with Meraki has really simplified our ability to enforce security at scale.

I think this program, this application is better for large company or for large users for enterprise level. But if a small company, I don't think we need to use this product.

Well suited for our needs to auth via certs. Allows for IoT devices to bypass auth.

One scenario I already mentioned is authentication integration. So that works well. We haven't run any situation where it is not suited, so we haven't run into that situation. So I am not really sure that would it work or not. But right now, so far so good.

I would say from a best suited perspective, any organization that has endpoints, definitely I would say knowing that they have infrastructure specific to Cisco or even any third party when it comes to having a network access control or a AAA server. I think even today based on the Gartner reports as well, ISE is the preferred option and I would definitely recommend is over any other AAA servers when it comes to not well suited or wherever I would not recommend using ISE is well I haven't come across any set scenario where I would not recommend ISE or I would recommend any other product. I think all the use cases or the task that the way ISE is designed to cater to multiple use cases, I think those are definitely valid use cases. I haven't seen much value, if I have to answer this question, something known as threat nac. I personally haven't seen much value in deploying ISE in that environment, so that is one of the areas I would not recommend or just because I haven't tested it, I would not recommend ISE yet.

That is a great product, but I need time to learn it. I wish the support for it is better. Some of the support engineers seem not to know the product well.

Cisco Identity Services Engine is suited well in ports security and identity however, it's complex in deployment and configurations for other devices.

Well suited for provisioning authenticated access to the network.

When onboarding a device in the network, we strictly have to authorize its access via Cisco Identity Services Engine. VSAs are a well used attribute as well.

Cisco Identity Services Engine is suited in almost all networks, but I like it particularly in wireless.

easy policy management

Very effective radius server in organizations

Cisco Identity Services Engine (ISE) is good for basic 802.1X based RADIUS, and TACACS+ usage. The profiling rules need to keep up to date for most common devices. The posture flow needs design changes, or best practice changes to accommodate user logon situations. Maybe, should allow user login first, then just catch the non-compliant only. For the pre-posture should be easier to let user access.

I give Cisco Identity Services Engine (ISE) an eight out of ten because my organization likes it.

Authorization and authentication work very well, the profiling and posturing as well. Interoperability with other Cisco products like firewalls and Catalyst Center are also really good. Currently reporting and visibility on the device are not as good. Scheduled reporting still needs to be more reliable.

User authentication for security

NAC and role based access is handled well. Integration with Cisco Catalyst Center is good.

Well suited for AAA authentication, radius authorization and profiling. Not currently using it for full Cisco SDA access.

For control to know who is connected to the network

Guest Wifi Authentication is done very well. Lots of possibilities. AAA Authentication is also done very well. Easy to setup and to manage. BYOD is not very good integrated might needs some improvement.

Cisco ISE is a great addition to any mid to large size business where you'd like to manage all your device authentication in one place. Cisco ISE will handle all your TACACS, MAB and 802.11x needs in a single pane of glass, which is great in itself, but you can also use it to manage VPN ACLs amongst other things. With all that said, ISE would be complete overkill for a smaller business as it's very expensive and would have too many features that would be wasted on a smaller network environment.

Cisco ISE works excellently as a NAC for network onboarding, maintaining persistent sessions, and overall alignment for Zero Trust Architectures. As a cornerstone to the Cisco TrustSec (CTS) environment, Cisco ISE provides the ability to tag hosts as they are onboarded and distribute this information throughout a security ecosystem, to be leveraged by firewalls, switching infrastructure, and server policing mechanisms. Its ability to maintain a persistent session allows other data reporting mechanisms to change the level of access to hosts if the compliance status were to change. The programmable back end allows for the management to be performed from a centralized console, or via the built-in GUI of the Cisco ISE product itself.

Cisco Identity Services Engine is well suited for VPN access policies and posturing. Very easy to implement and provides those extra checks and layers of security from devices trying to access your network. The Guest Access Portal needs revision it's clunky at times and only creates more work on the back end for support teams to setup access if needed.