FMC Integration with ISE Using pxGrid

What it is

pxGrid is a framework that lets security products share context, and the FMC uses it to learn from Cisco Identity Services Engine (ISE).

ISE knows who is on the network, on which device and with what access. The firewall can use that knowledge to write rules about users and groups instead of only about IP addresses.

In the pxGrid model, ISE is the publisher of session information, and the Secure Firewall Management Center (FMC) is a subscriber.

How it works

The FMC connects to ISE, they trust each other with certificates, and ISE then sends data.

What the FMC learns

When a user or device is authenticated, ISE has a session record that ties the IP address to the user, the device and other details. Through pxGrid, the FMC receives these records.

The data includes the user name and groups, and the address that the session uses. It can also include ISE attributes such as the security group tag, the endpoint device type and the endpoint profile.

The firewall can then use these in rules. Access control rules can match on users and groups, and on ISE attributes, which is much easier to read than a list of addresses.

Setting up the connection

The setup has three parts.

1. ISE side. The pxGrid service has to be enabled on an ISE node. The FMC appears as a client, and ISE can either approve it automatically or wait for an administrator to approve it.
2. Certificates. Each side needs to trust the certificate of the other. You import the ISE certificates into the FMC as trusted authorities, and you give the FMC a certificate that ISE trusts.
3. FMC side. In the FMC identity source settings, you add the ISE server and give the pxGrid and monitoring node names, the trusted authorities and the FMC certificate. A test button checks the connection.

Name resolution and time must be right. Certificate problems and wrong time are the most common reasons for a failed connection.

Realms and identity policy

For user and group names to be useful, the FMC also needs a realm for the directory, such as Active Directory. ISE provides the session, and the realm provides the user and group list.

An identity policy can then use ISE as a passive source. The firewall learns the user without asking the user to log in again. You can see the user names in events once this is working.

What pxGrid can do besides identity

The subscription is not the only use of pxGrid. The FMC can also send an action to ISE, for example to quarantine an endpoint. That is covered in the Rapid Threat Containment page.

Troubleshooting

If no user data appears, check these points in order.

• Is the pxGrid service running on ISE, and is the FMC approved as a client?
• Do the certificates match, and is each side trusted by the other?
• Can the FMC resolve and reach the ISE host names?
• Are the clocks in step?
• Does the realm exist and is it downloading users and groups?

Benefits

Rules that use identity follow the user from one address to another. When a person moves to a new network or a new IP address, the rule still applies. Events also become easier to read, because they show names instead of addresses.