ISE Deployment Assistant. Administration & User Guide

Transcription

1 ISE Deployment Assistant Administration & User Guide SecurView Inc

2 Contents 1 Introduction Audience IDA Benefits Readiness Assessment Generating Configuration for Network Devices Configuration Push to Devices System Requirements Pre-requisite Software System Administration Installation Uninstallation System Configuration & Usage Usage Flows Customer Account Management Customer Account Creation Customer Account Update ISE Environment Setup Add/Update Admin & Monitoring Nodes Add/Update Load Balancers & PSN Nodes User Management Provision New User Account Update Existing User Account Disable User Account Change User Account Password Compatibility Guide Management View Imported Compatibility Guide Import New Compatibility Guide Network Device Management Assessment Type Import Device(s) Using Template Add Device(s) Manually Location Groups Assign Location to Devices Edit Device Information Delete Device Filter or Search Options Device Readiness Assessment... 33

3 5.7.1 SSH Mode Quick Recommendation Check Change Assessment Type Collect Device Information Reassess Devices Assessment Summary Device Details Export Assessment Report Manage Service Templates Create New Service Template View Service Template Associated Network Devices Modify Service Template Search Service Template Manage Device Configuration Search Devices Search Device Interfaces Assign Service Templates/Edit Device Configuration Global Configuration Interface Configuration View Device Configuration View Device Configuration History Exception Scenarios Push Configuration Template Phases During the Config Push Config Push Summary Command Window Config Backup Device Config Validation Config Commit... 64

4 Figures Figure 1 - ISE Deployment Assistant Capabilities... 7 Figure 2 - Readiness Assessment Report Flow... 8 Figure 3 - Conduct Readiness Assessment Figure 4 - Configure Network Devices Figure 5 - New Customer Creation Figure 6 - Service Selection Figure 7 - Network Proxy Configuration Figure 8 - ISE Environment Setup Figure 9 - New User Wizard Figure 10 - Adding New User Figure 11 - Editing Existing User Details Figure 12 - Update the Changes to Existing User Figure 13 - Disabling User Account Figure 14 - Change Password Figure 15 View Compatability Guides Figure 16 - Compatability Guide Message Figure 17 - Network Device Management Figure 18 - Change Assessment Mode Figure 19 - Location Groups Figure 20 - Assigning Location to Devices Figure 21 - Edit Device Details Figure 22 - Delete Devices Figure 23 - Filter Devices Figure 24 - Options for Devices Figure 25 - Device Readiness Figure 26 - Device Readiness: Collecting Information Figure 27 - Device Readiness: Collecting Information Message Figure 28 - Collecting Information from Devices from SSH Figure 29 - Completed Message After Collecting Information Figure 30 - Reassess Devices Information Message Figure 31 - Device Readiness: Assessment Summary Figure 32 - Device Details Figure 33 - Options (Export Assessment Report) Figure 34 - New Template Creation Figure 35 - View Service Template... 42

5 Figure 36 - Associated Network Devices Figure 37 - Service Template in Edit Mode Figure 38 - Information Message from Service Template Figure 39 - Information Message from Service Template Figure 40 - Service Template Search Results Figure 41 - Device Search Results Figure 42 - Device Interface Search Figure 43 Device Interface Search Results Figure 44 - Assign Service Templates / Edit Device Configuration Figure 45 - Device In Edit Mode Figure 46 - Assigned Service Template for Global Configuration Figure 47 - Interface Configuration Figure 48 - Single Mode Figure 49 - View Device Configuration Figure 50 - View Device Configuration History Figure 51 - Device Config Exception Scenario Figure 52 - Push Configuration Template Figure 53 - Config Push: Phase One Figure 54 - Config Push: Phase Two Figure 55 - Config Push: Phase Three Figure 56 - Config Push: Phase Four Completion With Verification Errors Figure 57- Config Push: Phase Four - Completion With No Verification Errors Figure 58 - Config Push Summary in Process Figure 59 - Config Push Summary Complete Figure 60 - Command Window Showing Error Figure 61 - Command Window Showing No Errors Figure 62 Device Config Backup Figure 63 - Validation Report... 64

6 Modification Log Version Date Author Remarks /24/2016 SecurView Baselined for IDA ver 2.0

7 1 Introduction A typical Cisco ISE implementation s lifecycle consists of the following major activities. Customer Requirements Gathering Gap Analysis & Network Readiness Assessment High-Level design Lab validation o Deploy ISE servers in lab environment o Configure environment Authentication, Authorization and Posture polices in ISE Endpoints Templates for network access devices are created and validated. o It is very likely that several configuration templates are created and validated (based on location, use cases, network topology) Low-Level design o Created based on the results of testing and validation in the LAB Production Deployment o Deploy ISE servers in production environment o Configure environment Authentication, Authorization and Posture polices in ISE that were validated in the lab Endpoints o Configure network access devices using the validated configuration template(s). In most customer environments, this step is performed during a change window. Typically, few network access devices are configured (one at time) during the change window. SecurView ISE Deployment Assistant (IDA) is designed to provide an efficient and predictive rollout of Network Access Control policies using Cisco ISE. IDA is a multi-tenant application that helps accelerate Cisco ISE implementation. The application significantly reduces manual effort required to rollout ISE because it helps automate multiple tasks. Specifically, it reduces the duration of the following activities. Network Assessment Configuration of Network Access devices during production deployment phase Troubleshoot failed authentications

8 Figure 1 - ISE Deployment Assistant Capabilities 1.1 Audience IDA is designed for organizations looking to implement Cisco ISE or who are already using Cisco ISE for network admission control. This includes the following groups: Current or potential Cisco ISE customers Cisco ISE resellers Partners who work with current or potential Cisco ISE customers Cisco and SecurView Professional Services teams 1.2 IDA Benefits Rolling out Cisco ISE involves challenges at different stages Readiness Assessment

9 Readiness Assessment is a key phase in the rollout program. The rollout program s success is usually dependent on (1) the accuracy of the assessment and (2) the visibility into the amount of effort and costs for a given network. During the network readiness assessment phase, the customer is asked to provide their list of devices, hardware models, and IOS version. The ISE implementation engineer utilizes the information contained in the Cisco ISE Network Component Compatibility Guide published by Cisco SAMPG BU for hardware, software, and feature compatibility for Network Access Devices (NADs). The process, however, has numerous challenges described below. o o o o o o The number of network access devices (NADs) may range between a few hundred to several thousand, depending on the size of the organization The NADs typically include a variety of hardware models (differing in size and capacity) and support a range of operating systems. In total, the number of models and operating system versions can turn out to be a few hundred The CLI/GUI differ across hardware models and operating system versions. This increases the overall effort in collecting the data from the devices, at times making it quite impractical Accessing device CLI involves substantial technical expertise with the devices The minimum and recommended software version differs for various use cases Manual comparison across multiple software versions and OS types is prone to error IDA automates the Readiness Assessment completely. It collects the device configuration information over SSH and conducts an automated assessment to produce the results within a few minutes. The assessment results are free of any manual errors and the assessment report is saved in the database within IDA. Figure 2 - Readiness Assessment Report Flow

10 1.2.2 Generating Configuration for Network Devices Once the readiness is established, the next key step in the ISE rollout is to generate the NAD configuration in order to implement the use cases. This process has the challenges described below. o o o o o Configuration required on devices differ by the device type (wired/wireless) The configuration is often complex and needs expertise with the involved devices Creating an optimal configuration involves referring to multiple sources and best practices recommended by Cisco Any errors in the configuration may cause a risk on the change window and ultimately lead to network outage Manually-prepared configurations are difficult to apply to network devices IDA simplifies configuration generation by abstracting technical complexity and providing support to generate the device configuration based on the required use cases. The generated configuration can be saved as a reusable template that then can be assigned to multiple devices at the same time Configuration Push to Devices The process to push the configurations to the devices has associated risks due to the factors described below. o o o The process is completely manual and involves manual changes to be made in the configuration before it is applied to the devices The required care before changing any device configuration is not always exercised. This includes the checks to be made on the device for its current configuration, possible conflicts, taking backups before every change, etc. At the end of the configuration change, conducting manual verification is not always feasible. This leads to more troubleshooting effort in case something does not operate as expected Network Access Devices are configured during a scheduled change window. The typical duration of a change window can range between two to four hours. Initially, the duration of change window can be as long as four hours, which over time (as more NADs are configured) can be reduced to two hours. IDA makes this process very efficient and reliable by offering automated support for a number of tasks during the configuration push. This involves preparatory steps such as taking backups, checking for potential conflicts, maintaining historical records, and conducting automated command-to-command verification. IDA enforces all the recommended care and precautions that should be taken even when time is limited. 2 System Requirements

11 This product may be installed on any Windows 7 or higher laptop or desktop computer meeting the specifications described below. Operating System: Windows 7 or higher (64-bit) Processor: Intel Core i3 and higher Memory: 4 GB Hard disk: 1 GB free space 3 Pre-requisite Software Before proceeding with this product installation, please check that the software below is installed on the computer. Operating System Microsoft Windows 7 or 8 64-bit Pre-requisite software Microsoft Visual C SP1 Redistributable Package (x64) 4 System Administration 4.1 Installation The product s installation is straightforward. Follow the steps described below in order to install the product and run it. Download the distributable archive as applicable to your computer. Note that the archives for 32 and 64 bit Windows are different and may not work correctly if installed on a wrong platform Extract the distributable archive at a suitable location on your computer. The extracted directory becomes your installation location. For ease of maintenance, you are recommended to install the software at a location other than the default Windows installation directories Once the archive is fully extracted, launch the setup program using the batch script setup.bat in the root of the extracted folder. The script will launch the setup wizard Follow the procedure as suggested by the setup program. At step-3, confirm the port numbers that you want the product to use. Ensure that you have no other software installed on your computer that has the same port numbers configured. If you do have the same port numbers already configured, consider changing the port numbers to different values and then proceed with the next steps Once the port numbers are selected, the next step involves checking for the availability of the ports and configuring the software components to work on your environment. This step may take some time Once the installation is complete, the wizard provides confirmation. Click on the Finish button to complete the setup. By default, an option is selected to start the application processes. If the option is unchanged, the setup program will start the required services and provide confirmation and the URL to utilize the application. This step may take a few minutes Congratulations! You have successfully installed the software on your computer. You may access the software using any of the browsers below Supported Browsers:

12 Mozilla Firefox version 28 or higher Mozilla Firefox ESR version 31.2 Google Chrome version 39.0 Microsoft Internet Explorer version 9, 10, 11, or edge

13 4.2 Uninstallation Removing/uninstalling the application from your computer is simple. Stop the processes using the Shutdown launcher in the installation directory and delete the installed directory and all its components from the disk. 5 System Configuration & Usage 5.1 Usage Flows Figure 3 - Conduct Readiness Assessment Figure 4 - Configure Network Devices

14 5.2 Customer Account Management Customer Account Creation Note: During the initial IDA installation, the default administrative user account was created (i.e., admin user). To create a new customer, log into IDA with the admin user credentials. After successfully logging into IDA, the New Customer Setup wizard screen appears to the user (if user logs in for the first time). Steps to Create a New Customer Account: From Setup >> Manage Customers Click on the New Customer icon to create the new customer Under Customer Details : o o Enter the required Customer Name in the field Select the required ISE Software Version from drop-down list Note: If no values appear on the drop-down list, then please import the compatibility guide for the required ISE version. For more details, see Compatibility Guide Management section 4.2 o o Enter the customer s address details Click on the Next button Figure 5 - New Customer Creation

15 o o The customer will be created and displayed in the list of customers in the left panel. In addition, the newly created customer is incorporated into the customer context list Click on the Next button to move to the next step of the wizard - Service Selection. You may exit the wizard by clicking on the Cancel button Under Service Selection : o Select the ISE Services that you want to implement o Select the Compatibility guide for your assessment from the drop-down list o For details, see Compatibility Guide Management section 4.2 o Click on the Refresh button if the Compatibility guide has not downloaded yet o Click on the Next button Figure 6 - Service Selection o Click on the Next to proceed to the next step of the wizard the Network Devices page. You may exit the wizard at this stage by clicking on the Cancel button or move back to the Customer Details page by clicking on the Previous button Under Network Devices : o Click on the Change Mode button o Select the Assessment type as SSH or QRC from the drop-down list o For details, see the Device Readiness Assessment section o Include network device information. There are two methods to do this: uploading a CSV or entering the information manually o Uploading a CSV

16 o o Click on the Download Template button to download the CSV template Click on the Browse button to locate the device-list file and select it. The name of the file should be shown in the textbox next to Upload Devices CSV field. Click on the Upload File button to import the device list into IDA o Adding a device manually Below the Imported Devices section, click on the +Add button Fill in the appropriate network device information in the given fields Click on the Add button to save the device information. You may optionally click on the Cancel to cancel the operation You may click on the Previous button to move to the previous page if required When all network devices are shown under the Imported Devices section, select the network devices and click on the Run Assessment button Network Proxy Configuration (Optional) o Select the appropriate Proxy Type from the drop-down list o Fill in the IP Address and the Proxy Port o Fill in the Proxy Username and Proxy Password (not required) o Click on the Save button to commit the changes or click on the Cancel button to exit Figure 7 - Network Proxy Configuration Customer Account Update Existing customer accounts may be modified for business or technical details. Steps to Update an Existing Customer Account: From Setup >> Manage Customers Select the customer name in the left panel

17 Click on the Edit button Modify the customer details as required Click on the Update button to commit the changes or click on the Cancel button to exit 5.3 ISE Environment Setup The ISE Environment Setup contains information for all ISE nodes that are set up for the customer account. ISE Environment Setup details are required during service template generation and device config-validation Add/Update Admin & Monitoring Nodes Access the menu Setup >> Manage Customers and follow the steps as listed below Select the customer from the left panel On the right panel, click on the ISE Environment Setup tab Enter Admin Primary and Secondary node IP address Note: The Secondary node is optional. Enter Monitoring Primary and Secondary node IP Address Note: The Secondary node is optional. Enter User ID and Password for the ISE monitoring node Note: Please ensure that the ERS API is enabled on ISE and the user is assigned to groups Super Admin and ERS Admin Click on the Save button Node details may also be updated following the above steps Add/Update Load Balancers & PSN Nodes In case, the customer ISE setup has Load Balancer(s), they may also be entered under the Load Balancers & PSN Nodes section. Steps to Set Up the Load Balancer(s): Click on the Add+ button under the Load Balancers section Enter the Virtual IP address Select the Location from the drop-down list Enter a ShortName for the Load Balancer node Note: This Short Name will display in the PSN node as Load Balancer If required later, click on the Edit button to modify any of the Load Balancers and click on the Update button to commit the changes

18 Note: Load Balancers are optional in the ISE Environment Setup Figure 8 - ISE Environment Setup Steps to Set Up the PSN Nodes: Click on the Add button under the PSN Nodes section Enter the IP Address Select the Location from the drop-down list Provide a ShortName for the PSN node Select a load balancer from the drop-down if applicable If required later, click on the Edit button to modify any of the PSN Nodes and click on the Update button to commit the changes

19 5.4 User Management Depending on the requirement, additional user accounts may be created and managed using the menu Setup >> Manage Users. The admin user account should be used for this purpose Provision New User Account This section provides steps to add a new administrator user. Steps to Add a New User: From Setup >> Manage Users Click on the add New User icon Enter the user details Select the time zone as required Click on the Save button to create the new user account Click on the Cancel button to exit Figure 9 - New User Wizard

20 Figure 10 - Adding New User Update Existing User Account The user can update its own account information. Note: The user with administrator privilege can update all other existing user accounts. Steps to Update the Created User Details: From Setup >> Manage Users From the left panel, select the user that should be updated Click on the Edit button

21 Figure 11 - Editing Existing User Details Modify the user s details as desired Note: The Username cannot be modified once it is created. Click on the Update button Figure 12 - Update the Changes to Existing User

22 5.4.3 Disable User Account An existing user account may be disabled when no longer required. Steps to Disable User Account: From Setup >> Manage Users From the left panel, select the user that should be disabled from left Click on the Disable User Account icon (right icon) A message will appear that asks to confirm if you would like to disable the user account Click on the Yes button to commit the change or click on the No button to exit If you click on the Yes button, then the message User disabled successfully will appear Note: To disable the particular user, you need to have the admin privilege. Figure 13 - Disabling User Account Change User Account Password The password for an existing user account may be changed if required. Steps to Change User Password: From Setup >> Manage Users

23 From the left panel, select the required user Click on the Change Password icon (the middle icon) The Change Password wizard appears with fields to enter New Password and Confirm Password Click on the Save button to commit the change or click on the Reset button to clear the field Figure 14 - Change Password 5.5 Compatibility Guide Management View Imported Compatibility Guide Steps to View Imported Compatibility Guide: From Setup >> Manage Compatibility Guides All imported compatibility guides are listed The compatibility guides include the following information: File Name, ISE Version, Publish Date, and Status Notes: The File Name includes information about the ISE version, the revision date, and the version number. For example, the File Name ISE_1.4_24_Feb_2016_Doc_v25 informs the user that the compatibility guide is for ISE 1.4, the date it was published is February 24, 2016, and the revision number is 25. The compatibility guides are shared across all users and customer accounts.

24 All of the compatibility guides must have their status as Active in order to be used for Readiness Assessment. Figure 15 View Compatability Guides Import New Compatibility Guide The user has two methods to import Compatibility Guides that are shared across all users. Steps to Import a New Compatibility Guide: Note: The Compatibility Guide is available with the product installable on the Cisco website. From Setup >> Manage Customers Click on the new customer icon Click on the Information icon The user will be redirected to the Manage Compatibility Guide page From Setup >> Manage Compatibility Guide Browse and Select the appropriate Compatibility Guide Click on the Upload File button

25 Figure 16 - Compatability Guide Message 5.6 Network Device Management Devices are maintained per customer account in IDA. Devices may be managed using the Network Device Management screen. The screen provides options for below Search/filter on the network device-list Import additional network devices using the CSV template Adding device(s) manually Delete one or more devices Manage Location Groups Assign Location Group to devices Note: Network devices are maintained separately for each customer account in IDA. Please ensure that the correct customer account is selected in the customer drop-down list in the application header.

26 Figure 17 - Network Device Management Assessment Type There are two types of assessment modes: SSH and QRC. o o SSH This is a default Assessment Type on IDA. With this type, the IDA application connects to the network devices over SSH and collects the information in real-time. The collected information is then used for the Readiness Assessment. Assessments conducted using SSH is 100% accurate and have no chance of user induced error 1 Quick Recommendation Check (QRC) - This type may be selected in case there is no SSH access/connectivity available to the network devices. With this type, the device details such as hardware model and software version are provided to the IDA application manually to conduct the Readiness Assessment. Accuracy of the assessment results are thus dependent on the accuracy of the information provided to the application. This type should be used only if there is no SSH access between IDA and the network devices Steps to select Assessment Type: From New Customer >> Customer Details >> Service Selection >> Network Devices OR From Network Devices >> Manage Devices Click on the Change Mode button 1 Assuming the user has provided correct device inventory to the IDA application

27 Select SSH or Quick Recommendation Check (QRC) from the drop-down list Figure 18 - Change Assessment Mode Import Device(s) Using Template The user can download a CSV. template and manually fill in information about the network devices. Then the user can upload the CSV. file. Steps to Download/Upload Template: From Network Devices >> Manage Devices Click on the Download Template button to download a blank 'CSV' template. The default file name is InputCsvFile.csv The downloaded template contains a header record at the top. Leave the header record in place and add the entries from the immediate next line. The records should contain following fields separated by commas o Device Name Device Name should contain less than 33 characters and can contain alphanumeric characters or special characters, dashes (-), or underscores (_) o IP Address IP address should contain octet value in the range o Hostname Hostname should contain less than 33 characters and contain alphanumeric or special character (-), dash, dot (.), or underscore (_) o Username Username should contain less than 33 characters and should not contain comma (,) double quotes ("), backslash (\) and white space o Password Password should contain less than 33 characters and should not contain comma (,) double quotes ( ), backslash (\) and white space

28 o Enable Password - Enable Password contain have less than 33 characters and should not contain comma (,), double quotes ( ), backslash (\) and white space Enter all the details in the.csv file Save the template successfully with the.csv file extension Click on the Browse button Select the.csv file and click on the Upload button Note: If you enter any invalid value in the.csv file and try to upload the same file, you will receive an error during the upload process Add Device(s) Manually Devices may be added manually if less in number. The entries are added one at a time. Steps to Add the Device(s) Manually: From Network Devices >> Manage Devices Click on the +Add button Enter all details in the given fields o Device Name Device Name should contain less than 33 characters and can contain alphanumeric characters or special characters, dashes (-) or underscores (_) o IP (Address) IP address should contain octet value in the range o Hostname Hostname should contain less than 33 characters and contain alphanumeric or special characters (-), dash, dot (.), or underscore (_) o Username Username should contain less than 33 characters and should not contain comma (,) double quotes ("), backslash (\) and white space o Password Password should contain less than 33 characters and should not contain comma (,) double quotes ( ), backslash (\) and white space o Enable Password - Enable password should contain less than 33 characters and should not contain comma (,), double quotes ( ), backslash(\) and white space Note: The user needs to select the Product type if the Assessment Type mode is selected as Quick Recommendation Check (QRC). In SSH mode, the Product type drop-down list will be disabled. Click on the Add button to save the network device information or click on the Cancel button to exit Location Groups Location(s) and location group(s) may be defined as required to organize the device inventory in IDA. Once defined, Locations/Location Groups may be assigned to the devices in the inventory. Location Groups are specific to a customer account. Steps to Add New Location Groups: From Network Devices >> Manage Devices Ensure that the correct customer account is selected in the Customer drop-down list in the application header Click on the Location Groups icon In the Location Group pop-up window, select the node under which a location needs to be added

29 Click on the +Add in the top left corner to add a new location Fill in the Name and Description for the Location o Name This mandatory field should consist of the location s name. It should contain the length of 2 to 20 characters, two or more alphabets, and two or more numeric character. o Description This field should consist of the location s description. Click on the Add button to create the location or click on the Cancel button to exit Click on the Close button to close the pop-up window Figure 19 - Location Groups Assign Location to Devices The devices can be assigned locations to network devices to help differentiate them. Steps to Assign Location to Device: From Network Devices >> Manage Devices Click on the Assign Location icon The Assign Location wizard will appear Click on + All Locations icon Select the desired location Click on the OK button The new location will appear in the Location drop-down list when adding or editing a device

30 Figure 20 - Assigning Location to Devices Edit Device Information Device information may be updated if required. Steps to Edit Device Information: From Network Devices >> Manage Devices Click on the Edit icon Modify any of the information in the fields Click on the Update button to commit the changes or click on the Cancel button to exit

31 Figure 21 - Edit Device Details Delete Device The user can delete devices from the network device lists. Note: One pre-requisite to deleting any devices is that no other users should be logged in. Steps to Delete the Devices: From Network Devices >> Manage Devices Click on the checkbox next to any of the devices listed that you would like to delete Click on the Delete icon A message will appear that asks to confirm if you would like to delete the selected devices Note: All information related to the selected devices will be erased. Click on the Yes button to commit the change or click on the No button to exit If you click on the Yes button, then the device will disappear from the list

32 Figure 22 - Delete Devices Filter or Search Devices in the inventory may be filtered based on multiple fields. Steps to Filter the Devices: From Network Devices >> Manage Devices Click on the Filter icon A filter will appear and the Filter icon will be renamed to Clear Filter Add any of the information in the fields to filter the network devices accordingly

33 Figure 23 - Filter Devices Options Device inventory and the location group information may be exported in CSV format. These options generate CSV files that may be imported into Cisco ISE. From Network Devices >> Manage Devices Click on the Options icon in the top right corner There are currently two options in the menu o Export Devices as CSV: Clicking on this will download the 'Nad_Export_<customer_name>.csv' file o Export Location groups as CSV: Clicking on this will download the 'NDGS_Export_<customer_name>.csv' file Note: The Nad_Export_<customer_name>.csv file is used to export the device information and it will be helpful to upload it into ISE in Network Device section. The NDGS_Export_<customer_name>.csv file is used to export the device information and it will be helpful to upload it into ISE in the Network Device Groups section.

34 Figure 24 - Options for Devices 5.7 Device Readiness Assessment Once the device inventory is imported into IDA, Readiness Assessment may be conducted on the devices against Compatibility Guides officially published by Cisco. IDA supports two types of assessment SSH Automated assessment based on information collected over SSH QRC Quick Recommendation Check based on device information provided manually SSH Mode This is a default Assessment Type on IDA. With this type, the IDA application connects to the network devices over SSH and collects the information in real-time. The collected information is then used for the Readiness Assessment. Assessments conducted using SSH are 100% accurate and have no chance of user induced error Quick Recommendation Check This type may be selected in case there is no SSH access/connectivity available to the network devices. With this type, the device details such as hardware model and software version are provided to the IDA application manually to conduct the Readiness Assessment. Accuracy of the assessment results are thus dependent on the accuracy of the information provided to the application. This type should be used only if there is no SSH access between IDA and the network devices Change Assessment Type From the Assessment Type drop-down list, click on the Change Mode button and select either SSH or Quick Recommendation Check (QRC) option to change the Assessment Type.

35 Figure 25 - Device Readiness Notes: Once the information is collected through SSH, the type cannot be changed to QRC For SSH Assessment Type - The device credentials are mandatory For QRC Assessment type - The Product Type is mandatory field. The user can update the Product Type field from the Imported Device Table (for details see the Manage Devices section)

36 Figure 26 - Device Readiness: Collecting Information Collect Device Information This option is visible to the user if and only if the user selects the Assessment Type as SSH. Steps to Perform Collect Device Information: From Device Readiness >> Readiness Summary Select the ISE services that you would like to implement. The current options are: AAA, BYOD, Guest (with Web Auth), MDM, Posture, Profiling, and TrustSec Select the compatibility guide with the required ISE version for the assessment Select one or more devices by clicking on their checkboxes in the device list Click on the Collect Device Info button A message will appear that asks to confirm if you would like to proceed to collect the device information Click on the Yes button to continue or click on the No button to exit The info collection begins once the Yes button is clicked. The process runs four threads in parallel to collection information from the devices

37 Figure 27 - Device Readiness: Collecting Information Message Figure 28 - Collecting Information from Devices from SSH

38 Figure 29 - Completed Message After Collecting Information Reassess Devices The Readiness Assessment may be repeated for different service selections without triggering info collection from the devices by making use of the Reassess Devices feature. Steps to Reassess Devices: From Device Readiness >> Readiness Summary Select the ISE services as required. The current options are: AAA, BYOD, Guest (with Web Auth), MDM, Posture, Profiling, and TrustSec Select the compatibility guide of required version to use for the assessment Select one or more devices by clicking on their checkboxes in the Imported Device Table Click on the Reassess Devices button A message will appear that asks to confirm if you would like to proceed to reassess the devices Click on the Yes button to continue or click on the No button to exit If you click on the Yes button, then the reassessing of the devices will begin

39 Figure 30 - Reassess Devices Information Message Assessment Summary The Assessment Summary displays the results from the Collect Device Info operation. It provides the additional information about the device(s), such as which are compatible/non-compatible for hardware/software with respect to selected ISE service(s) and compatibility guide.

40 Figure 31 - Device Readiness: Assessment Summary Device Details The Device Details Info tab shows additional information collected from the device during the assessment: hardware/software support, ACL details, existing Radius Server configuration, TCAM Usage, and CPU Utilization. This tab also displays caveats/notes as published by Cisco. Figure 32 - Device Details

41 5.7.8 Export Assessment Report The Readiness Assessment results can be exported in the form of a detailed PDF report or in a CSV format by using the options provided in the top right corner of the screen. Figure 33 - Options (Export Assessment Report) 5.8 Manage Service Templates IDA helps generate reusable configuration templates for various services (use cases) supported by ISE. Specifically, following types of templates may be generated using IDA: Wired Global Template Wired Interface Template Wireless Device Configuration Create New Service Template Steps to Create New Service Template From Operation >> Manage Service Template Click on the New Service Template icon Select the service template from the Template Type drop-down list o The options are: Wired Global Template, Wired Interface Template, and Wireless Global Template Fill in the required fields for the specific template

42 Click on the Generate Template button to generate the configuration commands Click on the Save button to save the generated template Note: The saved templates are located in the Manage Service Template window s left panel. Figure 34 - New Template Creation Note: The user can modify the generated template's input details and click on the Save button to commit the changes to the template. The user will need to re-generate the template once again to see the reflected changes to the template. The user can also download the template by clicking on the Download icon or update the template by clicking on the Edit icon located above the Service Template s text-box View Service Template Steps to View Service Template: From Operation >> Manage Service Template From the left panel, click on the template from template list that you would like to view

43 Figure 35 - View Service Template Associated Network Devices For each saved configuration template, IDA shows a section for associated network devices. This section lists down any network devices to which the selected template has been applied in the past. Any change to the template will hence be applicable to the devices to which the template has been assigned 2. Steps to Display Associated Devices: From Operation >> Manage Service Template Click on the Associated Devices tab to display the devices and their respective template details 2 This is applicable only to the assigned status. If the template has already been pushed to the device, then a change in the template does not have any impact on the device.

44 Figure 36 - Associated Network Devices Modify Service Template Steps to Modify Service Template: From Operation >> Manage Service Template Select the respective template from template list that you would like to modify Click on the Edit icon

45 Figure 37 - Service Template in Edit Mode Modify the template details as desired Click on the Update button to commit the changes Figure 38 - Information Message from Service Template

46 5.8.5 Search Service Template Steps to Search for a Saved Service Template: From Operation >> Manage Service Template Use the Search bar in the top left corner Type in specific details or select options from the drop-down list to find the desired saved template(s) o The field options are: Template Name, Template Type, ISE Services, and Associates Device IP Figure 39 - Information Message from Service Template Figure 40 - Service Template Search Results

47 5.9 Manage Device Configuration The service templates created for a customer account are used to configure the network devices for required ISE services. The device configuration can be managed using the Manage Device Configuration interface. Note: Service Templates can be assigned to the devices assessed with SSH mode only Search Devices Steps to Search for a Device: From Operation >> Manage Device Configuration Use the Search bar in the top left corner Type in specific details or select options from the drop-down list to find the desired device(s) o The field options are: Device Name, IP Address, Device Type, and Hardware Model An executed search may be revisited and modified by clicking on the search bar Click on the Cancel button on the search bar to remove the search filter Figure 41 - Device Search Results Search Device Interfaces Steps to Search for a Configuration: From Operation >> Manage Device Configuration Use the Search bar below the Interface Configuration heading Type in specific details to find the desired configuration(s)

48 o You can search the interface name, interface status, interface mode, configuration status, service template, and other criteria to find the desired configuration(s) Figure 42 - Device Interface Search Figure 423 Device Interface Search Results

49 5.9.3 Assign Service Templates/Edit Device Configuration Service Templates available under a customer account may be assigned to network devices as per the required services. Wired service templates may be assigned to multiple devices at a time. The assigned templates may be pushed to the devices using IDA during the change windows. Steps to Assign Service Template(s) to a Device: From Operation >> Manage Device Configuration Select the required device on the left panel Click on the Edit Configuration button in the device title bar. Once in the edit mode, the page will show drop-down lists at global and interface level. The drop-down lists will provide the available service templates under the customer account Select the desired templates from Service Template drop-down list at the required levels 3 Click on the Save button to commit the changes 3 To a wired device, templates may be assigned at multiple levels. A single template can be assigned at the global level and one against each interface.

50 Figure Assign Service Templates / Edit Device Configuration Figure 44 - Device In Edit Mode Global Configuration Most devices, especially the wired variants, need configuration at global level and a different type of configuration at the interface level. Using IDA, service templates may be assigned at both levels. Wireless devices support only global level configuration. Note: A Service Template can be assigned at a level where Config Status is either Initial/Assigned/Manually Updated/Pending Manual Update/ Auto updated/push Config errored/push Config failed. Steps to Assign the Service Template to Wired/Wireless Devices: From Operation >> Manage Device Configuration In the left panel, select the wired/wireless device Click on the Edit Configuration button Under Global Configuration, select the service template from Service Template drop-down list Click on the Save button to commit the changes or click on the Cancel button to exit Note: The Config Status changes from 'Initial' to 'Assigned*' once a service template is selected. Once the association is saved, the status changes to Assigned.

51 Figure Assigned Service Template for Global Configuration Interface Configuration The Interface Configuration is applicable to wired devices only. In the edit mode, service templates may be assigned at each interface level. Note: A Service Template can be assigned at a level where Config Status is either Initial/Assigned/Manually Updated/Pending Manual Update/ Auto updated/push Config errored/push Config failed Multiple Mode This is a default mode on IDA and is helpful to assign a single template to multiple interfaces at the same time. Note: Interface(s) should be selected before applying the template. Steps to Assign a Service Template in Multiple Mode: From Operation >> Manage Device Configuration Click on the Edit Configuration button Select Multiple under the Interface Configuration heading Select the desired service template from the Service Template drop-down list Click on the Convert the interface(s) to access mode if not already checkbox Enter the Data VLAN and Voice VLAN as applicable. The VLAN values should be less than 4094 Click on Select All Interfaces to select all the interfaces or use the checkboxes to select the desired interfaces

52 Click on the Assign button The selected interfaces will have their Config Status changed from Initial to Assigned* Click on the Save button to save the template assignment The Config Status for the configurations will change from Initial to Assigned Figure Interface Configuration Single Mode This mode is helpful the templates need to be assigned to the interfaces individually. Steps to Assign the Template in Single Mode: From Operation >> Manage Device Configuration Click on the Edit Configuration button Select Single under the Interface Configuration heading Select the service templates as required against the required interfaces Click on the Save button to save the template assignment

53 Figure Single Mode View Device Configuration Steps to View Device Configuration: From Operation >> Manage Device Configuration The screen is divided into two vertical panes. The left pane lists the network devices in the customer inventory whereas the right pane shows details for the configuration of the selected device By default, on the left pane, the first device in the list is auto-selected and its details are shown in the right pane Under the device name on the right panel, the date time when the device information was collected is shown. For any error free change to be executed, it is recommended to refresh this information before editing the device configuration using IDA A wired device configuration is divided into two sections Global Configuration and Interface Configuration. The Interface Configuration section shows the details of all physical interfaces on the device with their respective details. o Interface mode This is displayed in brackets next to the interface name. It specifies if the interface is configured in trunk/routed/access mode. If there is no configuration of the interface, a value ModeUnconfigured is displayed o Status This field specifies the status of the physical connection of the interface. The possible values are Connected and Disconnected o Config Status This field indicates the config status of the interface. The possible values include the following: Initial indicates that IDA has not been used in the past to assign/push any configuration. Such interfaces may be modified using IDA for configuration

54 Assigned indicates that a service template has been marked as assigned to it. The name of the template is displayed against the Service Template field Auto-updated indicates that a service template has recently been pushed through IDA to the interface. The name of the template is displayed against the Service Template field Pending Manual Update indicates that the template specified against the Service Template field is expected to be pushed to the interface using an external tool Manually updated indicates that the template specified against the Service Template field has been pushed to the interface using an external tool Config push errored indicates that IDA has encountered an error during automated config push to the interface. A different service template may be assigned to the interface in this status Figure View Device Configuration View Device Configuration History IDA keeps record of all changes done to the device configuration using IDA. The details include the user identity, timestamp of the change, name of the service template used during the change, and the status of the change itself. In addition to this, IDA keeps record of the configuration backups taken before each config push. The backed up configs may be downloaded from these records. Steps to View Device Configuration History: From Operation >> Manage Device Configuration Select the device from available device list

55 Click on the History option displayed near the right edge of the page. This is a collapsible panel which expands when clicked Once the details are checked and panel is no longer required, it can be collapsed using the option provided Figure 50 - View Device Configuration History Exception Scenarios If the Readiness Assessment has not been performed on a network device, an error is displayed on the screen as shown below. The error can be resolved by executing the readiness assessment for the device using SSH.

56 Figure 51 - Device Config Exception Scenario Push Configuration Template The assigned templates can be pushed to the device in an automated manner using the Config Push button. Steps to Push Configuration Template(s) to the Device: From Operation >> Manage Device Configuration Select the desired config objects at the global and/or interface level using the check-box options Click on the Push Configuration button to push the assigned templates to the device o IDA connects to the selected device over SSH and applies the configuration commands from the assigned templates. Before pushing the configuration, IDA takes a backup of the device s running configuration and saves it in the configuration history Monitor the Push Configuration progress and follow the procedure o In rare cases, the process may end in a failure. If it does, investigate the root cause of the failure using the diagnostic interfaces provided by IDA and correct the device s running config

57 Figure 49 - Push Configuration Template Phases During the Config Push There are four phases that IDA follows during the config push. Phase One: Config Backup Back up the current running configuration on the device in the IDA database with a timestamp Commit the running configuration to the device s memory. This is provided as an option which is selected by default. If not required, the option should be de-selected IDA displays a dialog to inform the user and also read the user s choice regarding the config commit. The config push process actually starts only when the OK button is clicked

58 Figure Config Push: Phase One Phase Two: Check for any name conflicts To ensure that there are no unforeseen issues after the config push, IDA does a thorough check for any name conflicts. The conflicts are checked at the following two levels: Among the selected service templates Between the selected service templates and the device s running configuration Conflicts, if any, are displayed to the user before proceeding with the further process. The pop-up window shows details about both the conflict categories and seeks confirmation from the user to proceed. The user may optionally click on the No button to exit the process.

59 Figure Config Push: Phase Two Phase Three: Config Push During this phase, the configuration from the selected templates is actually pushed to the device The process picks up a global service template (if any) and then follows with the templates at the interface level Commands are pushed to the device over SSH and the output is collected. The overall command execution details are shown in the command window near the bottom left corner of the page. The command window is useful to spot any errors during the command execution process In addition to the this, real-time updates are shown in the summary window as well as next to each selected service template With all of the above details, the process becomes easier to follow

60 Figure Config Push: Phase Three Phase Four: Config Verification During this phase, the running config on the device is verified. This is to see if the configuration in the service templates used for the config push reflect as expected in it. In case of any issues during this phase, they are displayed in a pop-up window at the end of the verification process. Note: Errors during the verification do not mean that the configuration is rolled back. The user is expected to check if the device configuration does not reflect the highlighted commands. This may happen in case of commands unknown 4 to the IDA application. In most cases, the commands do reflect but in a slightly different way than expected. 4 IDA permits manual edits to the generated Service Templates. Some additional commands may thus be present in the service templates that are unknown to the IDA application.

61 Figure Config Push: Phase Four Completion With Verification Errors Figure 54- Config Push: Phase Four - Completion With No Verification Errors

62 Config Push Summary IDA displays a real time update while the config push process is on. The summary is shown at the top right corner of the page and it provides details, such as number of templates processed, the current template being processed, and the overall process s percentage completion. Figure 55 - Config Push Summary in Process Figure 56 - Config Push Summary Complete Command Window When the push config is in progress, the Command Window shows the line by line command execution on the device. This is helpful because it makes the errors (if any) easy to find. The user may review the entire set of commands for any errors at the end of the config push process. The command window will not close automatically at the end of the process. Note: The Command Window is simply the device terminal log.

63 Figure 60 - Command Window Showing Error Figure 61 - Command Window Showing No Errors Config Backup

64 IDA takes back up of the device s running configuration and stores it into its database as a part of detailed audit history. The config backup records are highlighted with a dark gray background on the history tab. The backup records provide a download option using which the backed-up config may be downloaded. Figure 62 Device Config Backup Device Config Validation Once the Service Templates are pushed to the device, the device configuration may be validated using IDA. This feature correlates the configuration on the device against the information found in ISE. The correlated information is presented in a form of a spreadsheet based report which is very useful to check if the configuration is working as expected. Steps to Generate the Config Validation Report: From Operation >> Manage Device Configuration After the push config process is complete, wait for at least 5 minutes. This allows enough time for the endpoints connected to the device to authenticate against ISE and become rightly profiled and processed by ISE as per the configured policy Click on the Validate button o This starts the validation process that connects to the device over SSH and to ISE over the API. The correlated information is then presented in the form of a spreadsheet based report Download the report once generated

65 Figure 57 - Validation Report Config Commit Once the applied configuration has been validated and confirmed to be correct, the running configuration on the device may be committed by using the Commit button on the Manage Device Configuration page. The commit is required to be manually initiated by the user.