Integrate with Cisco ISE

Topology

This topic assumes Cisco ISE has been set up properly as a NAC solution, to work with a switch which has CoA enabled.

To integrate FortiDeceptor with Cisco ISE:

1. Configure Cisco ISE.
2. Configure the Authorization Policy.
3. Check the configuration
4. Configure FortiDeceptor.
5. Quarantine the endpoint.
6. Un-quarantine the endpoint.

1. Configure Cisco ISE

1.1 Configure the ERS on Cisco ISE

Please refer to the Cisco developer documentation on how to enable the ERS interface and configure the ERS admin account on Cisco ISE. This ERS admin account must be enabled with REST API and will be used by FortiDeceptor to communicate with Cisco ISE to quarantine and un-quarantine the attackers by IP.

1.2 Create a new policy in Cisco ISE

1. In Cisco ISE, go to Policy > Policy Sets.
2. Click the + button, and type a name in the Policy Set Name field such as Fortinet Policy.
3. In the Conditions column, click +.

   

4. In Conditions Studio, click Click to add an attribute.
5. In the Editor pop-up window, type device type.
6. In the Attribute box, click Choose from list or type and select All Device Types.
7. Click Use.

   

   The new policy will look like the image below.

   

2. Configure the Authorization Policy

1. In the View column, click on the arrow >.

   

2. Click + to the left side of the Status column. A new authorization is generated.
3. In the Rule Name column, enter a name such as ftnt_EPS_rule.

   

4. In the Conditions column, click +.
5. In Conditions Studio, in the Editor, click Click to add an attribute.
6. in the Attribute box, type EPS and select EPSStatus.

   

7. Click Choose from list or type and select Quarantine from the dropdown list.

   

8. Click Use.

3 Check the configuration

If each network component is configured properly, the endpoint will be authenticated successfully. In Windows 10, use the Command Prompt of Windows 10, to verify the IP address is acquired and the DHCP server is pingable.

In Cisco ISE go to Operations > RADIUS > Live Logs. The endpoint should be displayed.

4. Configure FortiDeceptor

1. In FortiDeceptor, go to Fabric > Quarantine Integration and click Quarantine Integration With New Device.

2. Configure the integration settings and click Save.

   Enabled	Enable
   Name	Enter a descriptive name for the integrations.
   Integrate Method	Select Cisco-ISE.
   ServerURL/IP	Enter the IP address for Cisco ISE.
   Username	Enter the username for Cisco ISE.
   Password	Enter the password for Cisco ISE.
   Expiry	Set the expiry in seconds.

   

3. Verify the Status is Ready.

   

5. Quarantine the endpoint

1. Attack a decoy deployed in FortiDeceptor from the endpoint. When FortiDeceptor detects the attack has occurred, a quarantine of REST API with the IP address of the endpoint will be sent to Cisco ISE.
2. In FortiDeceptor go to Fabric > Quarantine Status, to verify the quarantine was successful.

   

3. On the endpoint, you should see the status of the network adapter becomes Authentication failed and DHCP server is no longer pingable.
4. In Cisco ISE, navigate to the Live Logs.
   • In the Authorization Profiles column, you should see PermitAccess is replaced by DenyAccess.
   • In the Authorization Policy column Fortinet Policy >> Default changes to Fortinet Policy >> ftnt_EPS_quarantine.

   

6. Un-quarantine the endpoint

After 120 seconds, un-quarantine of REST API is sent to Cisco ISE from FortiDeceptor. At the same time, Status of Quarantine Status changes to Quarantine stopped.

On the endpoint, the status of the network adapter is Resumed and the DHCP server becomes pingable.

In Cisco ISE go to Live Logs:

• In the Authorization Profiles column, DenyAccess changes to PermitAccess.
• In the Authorization Policy column Fortinet Policy >> ftnt_EPS_quarantine changes to Fortinet Policy >> Default.
•