Cisco ISE v2.1.1

About the connector

Cisco ISE connector provides actions like, list all active sessions, quarantine IP/Mac address, un-quarantine IP/Mac address etc.

This document provides information about the Cisco ISE connector, which facilitates automated interactions, with a Cisco ISE server using FortiSOAR™ playbooks. Add the Cisco ISE connector as a step in FortiSOAR™ playbooks and perform automated operations with Cisco ISE.

Version information

Connector Version: 2.1.1

Authored By: Community

Certified: No

Release Notes for version 2.1.1

Following enhancements have been made to the Cisco ISE connector in version 2.1.1:

• Fixed the issue where the health check was failing with error 406 when the response format was set to JSON.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-cisco-ise

Prerequisites to configuring the connector

• You must have the credentials of Cisco ISE server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Cisco ISE server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Cisco ISE connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: List All Active Sessions

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "result": {
        "activeList": {
            "@noOfActiveSession": ""
        }
    },
    "request_status": ""
}

operation: Get Internal User Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "InternalUser": {
        "id": "",
        "link": {
            "rel": "",
            "href": "",
            "type": ""
        },
        "name": "",
        "enabled": "",
        "lastName": "",
        "password": "",
        "firstName": "",
        "changePassword": "",
        "identityGroups": "",
        "passwordIDStore": "",
        "customAttributes": {
            "Static-IPv4-Addr": ""
        },
        "expiryDateEnabled": ""
    }
}

operation: List Internal Users

Input parameters

Output

The output contains the following populated JSON schema:

{
    "SearchResult": {
        "total": "",
        "nextPage": {
            "rel": "",
            "href": "",
            "type": ""
        },
        "resources": [
            {
                "id": "",
                "link": {
                    "rel": "",
                    "href": "",
                    "type": ""
                },
                "name": ""
            }
        ]
    }
}

operation: Disable Internal User

Input parameters

Output

The output contains the following populated JSON schema:

{
    "UpdatedFieldsList": {
        "updatedField": [
            {
                "field": "",
                "newValue": "",
                "oldValue": ""
            }
        ]
    }
}

operation: Enable Internal User

Input parameters

Output

The output contains the following populated JSON schema:

{
    "UpdatedFieldsList": {
        "updatedField": [
            {
                "field": "",
                "newValue": "",
                "oldValue": ""
            }
        ]
    }
}

operation: List Guest Users

Input parameters

Output

The output contains the following populated JSON schema:

{
    "SearchResult": {
        "total": "",
        "resources": [
            {
                "id": "",
                "name": "",
                "description": "",
                "link": {
                    "rel": "",
                    "href": "",
                    "type": ""
                }
            }
        ]
    }
}

operation: Get Guest User Details

Input parameters

Output

The output contains the following populated JSON schema:

{
    "GuestUser": {
        "id": "",
        "name": "",
        "description": "",
        "guestType": "",
        "sponsorUserName": "",
        "guestInfo": {
            "userName": "",
            "emailAddress": "",
            "phoneNumber": "",
            "password": "",
            "enabled": "",
            "smsServiceProvider": ""
        },
        "guestAccessInfo": {
            "validDays": "",
            "fromDate": "",
            "toDate": "",
            "location": ""
        },
        "portalId": "",
        "customFields": {
            "another key": "",
            "some key": ""
        },
        "link": {
            "rel": "",
            "href": "",
            "type": ""
        }
    }
}

operation: Suspend Guest User

Input parameters

Output

The output contains the following populated JSON schema:

The output contains a non-dictionary value.

operation: Reinstate Guest User

Input parameters

Output

The output contains the following populated JSON schema:

The output contains a non-dictionary value.

operation: EPS: Quarantine IP Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: EPS: Quarantine MAC Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: EPS: Un-Quarantine IP Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: EPS: Un-Quarantine MAC Address

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: End a Target MAC Address Session

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: MAC Address Logout

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: Get Endpoints

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when the "Get Endpoint By" is not specified:

{
    "SearchResult": {
        "total": "",
        "resources": [
            {
                "id": "",
                "name": "",
                "link": {
                    "rel": "",
                    "href": "",
                    "type": ""
                }
            }
        ]
    }
}

This is the default output schema:

{
    "ERSEndPoint": {
        "id": "",
        "name": "",
        "description": "",
        "mac": "",
        "profileId": "",
        "staticProfileAssignment": "",
        "groupId": "",
        "staticGroupAssignment": "",
        "portalUser": "",
        "identityStore": "",
        "identityStoreId": "",
        "link": {
            "rel": "",
            "href": "",
            "type": ""
        }
    }
}

operation: Get ANC Endpoint

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when the "ANC Endpoint ID" is not specified:

{
    "SearchResult": {
        "total": "",
        "resources": [
            {
                "link": {
                    "type": "",
                    "rel": "",
                    "href": ""
                },
                "id": ""
            }
        ]
    }
}

This is the default output schema:

{
    "ErsAncEndpoint": {
        "policyName": "",
        "id": "",
        "link": {
            "rel": "",
            "type": "",
            "href": ""
        },
        "macAddress": ""
    }
}

operation: Create ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: Get ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:

Output schema when the "Get Policy By" is not specified:

{
    "SearchResult": {
        "total": "",
        "resources": [
            {
                "id": "",
                "name": "",
                "link": {
                    "rel": "",
                    "href": "",
                    "type": ""
                }
            }
        ]
    }
}

This is the default output schema:

{
    "ErsAncPolicy": {
        "id": "",
        "name": "",
        "actions": [],
        "link": {
            "rel": "",
            "href": "",
            "type": ""
        }
    }
}

operation: Assign ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

operation: Revoke ANC Policy

Input parameters

Output

The output contains the following populated JSON schema:

{
    "request_status": "",
    "result": {}
}

Included playbooks

The Sample - Cisco ISE - 2.1.1 playbook collection comes bundled with the Cisco ISE connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Cisco ISE connector.

• Assign ANC Policy
• Create ANC Policy
• Disable Internal User
• EPS: Quarantine IP Address
• EPS: Quarantine MAC Address
• EPS: Un-Quarantine IP Address
• EPS: Un-Quarantine MAC Address
• Enable Internal User
• End a Target MAC Address Session
• Get ANC Endpoint
• Get ANC Policy
• Get Endpoints
• Get Guest User Details
• Get Internal User Details
• List All Active Sessions
• List Guest Users
• List Internal Users
• MAC Address Logout
• Reinstate Guest User
• Revoke ANC Policy
• Suspend Guest User

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.