Persistent Data Transfer Procedure

Transcription

1 This chapter describes exporting and importing Cisco Secure ACS, Release 5.5 or 5.6 data into Cisco ISE, Release 1.4 system using the migration tool. Exporting Data from Cisco Secure ACS, page 1 Analyzing Policy Gap between Cisco ISE and Cisco Secure ACS, page 4 Importing Data in to Cisco ISE, page 6 Migrated Data Verification in Cisco ISE, page 9 Exporting Data from Cisco Secure ACS After starting the migration tool, complete the following steps to export data from Cisco Secure ACS to the migration tool. Step 1 Step 2 Step 3 Step 4 In the Cisco Secure ACS to Cisco ISE Migration Tool window, click Settings to display the list of data objects available for migration. (Optional) You are not required to configure the dependency handling in order to perform migration. Check the check boxes of the data objects you want to export in case their dependency data is missed and click Save. In the Cisco Secure ACS to Cisco ISE Migration Tool window, click Migration and then click Export From ACS. Enter the IP address (or hostname) and the password for the Cisco Secure ACS, Release 5.5 or 5.6 system and click Connect in the ACS5 Credentials window. 1

2 Exporting Data from Cisco Secure ACS Step 5 Monitor the migration process in the Cisco Secure ACS to Cisco ISE Migration Tool window, which displays the current count of successful object exports and lists any objects that triggered warnings or errors. Step 6 To get more information about a warning or an error that occurred during the export process, click any underlined numbers in the Warnings or Errors column on the Migrations tab. The Object Errors and Warnings Details window displays the result of a warning or an error during export. It provides the object group, the type, and the date and time of a warning or an error. 2

3 Exporting Data from Cisco Secure ACS Step 7 Step 8 Scroll to display the details of the selected object error, and then click Close. When the data export process is completed, the Cisco Secure ACS to Cisco ISE Migration Tool window displays the status of export that Exporting finished. Step 9 Click Export Report(s) to view the contents of the export report. Each export report contains header information with the operation type, date and time, and system IP address or host name. Each object group details the types and related information. Reports end with a summary of the start and end date, the time, and the duration of the operation. 3

4 Analyzing Policy Gap between Cisco ISE and Cisco Secure ACS Step 10 To analyze the policy gap between Cisco Secure ACS and Cisco ISE, click Policy Gap Analysis Report. Analyzing Policy Gap between Cisco ISE and Cisco Secure ACS After exporting the data, administrator should analyze the export report and the policy gap report, fix the listed errors in the ACS configuration and address the warnings and other issues. The following gaps are observed for a configuration set that is migrated from Cisco Secure ACS to Cisco ISE. Reconciliation is possible for some of these gaps. Identity Groups Internal User Issues Parity gap between Cisco Secure ACS and Cisco ISE Password type Password change on next login Password change Naming constraints External Identity Stores are migrated successfully. You have to verify the names. Network Devices or Network Device Groups Network device migration caveats for Cisco ISE 2.1 4

5 Analyzing Policy Gap between Cisco ISE and Cisco Secure ACS IP ranges that are not supported in Cisco ISE Exclusion is for overlapping IPs IPV4 only Default Device must have RADIUS enabled Reconciliation flow for migration tool If the device does not exist in Cisco ISE (defined by no overlap of IP configuration), then the device will be added during migration. If the device exists (IP or subnet matches exactly and name matches exactly), then the migration tool adds the TACACS+ elements If the device exists (IP/subnet matches exactly or name matches exactly), then the migration tool reports error Authorization Results Command Sets and Shell Profiles are migrated successfully. Inconsistency would be with object names. Cisco ISE strictly adheres to names Policy results namespace shared with Network Access users Recommendation is to use a prefix for Device admin authorization results Policies Cisco Secure ACS 5.x Access Service separated from Selection Policy Can have services that are not engaged Can have services selected by different Service Selection rules Cisco Secure ACS 5.x Group map Transition of group map from Cisco Secure ACS 4.x Group map content must be migrated to authorization Policy in Cisco ISE Authentication allowed Protocols Part of Service configuration in Cisco Secure ACS 5.x Part of Policy Results in Cisco ISE After addressing the errors or warnings, perform the export process again. For the procedure of exporting data from Cisco Secure ACS, see Exporting Data from Cisco Secure ACS, on page 1. 5

6 Importing Data in to Cisco ISE Importing Data in to Cisco ISE Step 1 Step 2 In the Cisco Secure ACS to Cisco ISE Migration Tool window, click Import To ISE. Click OK when you are prompted to add attributes to the LDAP identity stores before they are imported into Cisco ISE. Step 3 From the LDAP Identity Store drop-down list, choose the identity store to which you want to add attributes, and click Add Attribute. 6

7 Importing Data in to Cisco ISE Step 4 Step 5 Enter a name in the Attribute Name field, choose an attribute type from the Attribute Type drop-down list, enter a value in the Default Value field, and click Save & Exit. After adding attributes, click Import To ISE, enter the Cisco ISE Fully Qualified Domain Name (FQDN), username, and password in the ISE Credentials window and click Connect. The migration tool ensures that this matches the FQDN in the SSL certificate. Step 6 Step 7 When the data import process is completed, the Cisco Secure ACS to Cisco ISE Migration Tool window displays the status of import as Importing finished. To view a complete report on the imported data, click Import Report(s). 7

8 Importing Data in to Cisco ISE Step 8 Step 9 To get more information about a warning or an error that occurred during the import process, click any underlined numbers in the Warnings or Errors column on the Migrations tab. To analyze the policy gap between Cisco Secure ACS and Cisco ISE, click Policy Gap Analysis Report. Step 10 Click View Log Console to display the real-time view of the export or import operations. 8

9 Migrated Data Verification in Cisco ISE Migrated Data Verification in Cisco ISE To verify that the Cisco Secure ACS data is migrated into Cisco ISE, log into the Cisco ISE and check that the various Cisco Secure ACS objects can be viewed. 9

10 Migrated Data Verification in Cisco ISE 10