ePub(1.7 MB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle)(1.3 MB) View on Kindle device or Kindle app on multiple devices
Updated:September 29, 2023
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This document describes how to configure Cisco Identity Service Engine 3.3 pxGrid Direct Connector with external REST APIs to get endpoints data.
Cisco recommends that you have knowledge of these topics:
Cisco ISE 3.3
The information in this document is based on these software and hardware versions:
Cisco ISE 3.3
REST API Server that provided JSON data for endpoints attributes
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Cisco pxGrid Direct helps to evaluate and authorize the endpoints faster by enabling you to connect to external REST APIs that provide JSON data for endpoint attributes and fetch this data into the Cisco ISE database. This feature eliminates the need to query for endpoint attribute data each time an endpoint must be authorized. You can then use the fetched data in authorization policies.
pxGrid Direct helps collect data based on the attributes you specify in your pxGrid Direct configurations. Two mandatory fields called Unique Identifier and Correlation Identifier are used to fetch relevant data. If a connector does not contain values for either of these fields, the fetching and saving of data from a connector can be erroneous.
Configure pxGrid Direct Connectors
Step 1. Add a new pxGrid Direct Connector
In order to configure pxGrid Direct Connector, from ISE navigate to Administration > Network Resources > pxGrid Direct Connectors. Click Add.
Once the Welcome page for the pxGrid Direct Connect Wizard is open click
Step 2. Define the pxGrid Direct Connector
Give a name to the connector, and a description, if needed. Click Next.
Warning: Check the Skip Certificate Validations check box to allow Cisco ISE to accept any certificate that a server presents without verifying the hostname or other details. You must check this check box only in a test environment or if you trust the connected server to be highly secure. Typically, skipping certificate validations could make your network vulnerable to machine-in-the-middle attacks.
Step 3. URL
Type the URL of the external REST API that provides JSON data for endpoints attribute.
Under Authentication, enter the username and password of the external REST API server.
Select Test Connection, wait for the Successful message, then Click Next.
Tip: The Incremental URL is optional for the configuration. In case the External REST API has Request Arguments, these can be used to get the latest information by filtering with the specific argument instead of requesting all the data. Ensure the Request Argument exist with the documentation of the External REST API server.
Step 4. Schedule
Select the Schedule for a FULL SYNC.
Default value - 1 week
Minimum value - 12 hours
Maximum value - 1 month
Select the Schedule for INCREMENTAL SYNC. This option only appears if it was configured in Step 3.
Default value - 1 day
Minimum value - 1 hour
Maximum value - 1 week
Step 5. Parent Object
You must type the JSON key to search for attributes.
Step 6. Attributes
Select the Attributes of the JSON to configure Dictionary Items that can be used for policies.
In this scenario, the attributes included in Dictionary are:
Step 7. Identifiers
Select the Unique Identifier attributes that are unique to an endpoint from the CMDB database and where the External REST API server obtains the JSON.
Select the Correlation Identifier attributes that are unique to ISE and that can match an endpoint to an authorization policy.
Step 8. Summary
Ensure the pxGrid Direct Connector is configured properly. Click Done.
Once the connector is done, it appears under the pxGrid Direct Connectors page.
Step 9. Verification
From ISE, navigate to Policy > Policy Elements > Dictionary > System Dictionaries. Filter by the name of your pxGrid Direct Connector. Select it and click View.
Navigate to Dictionary Attributes and see the list of attributes configured as Dictionary Items under step 6.
Context Visibility pxGrid Direct Dashboard
From ISE, navigate to Context Visibility > Endpoints > More > pxGrid Direct Endpoints. A list appears of the endpoints with the values selected for Correlation and Unique Identifiers.
Click the Correlation ID to view the Details, or Download the attributes of an specific endpoint.
Authorization Policy Configuration with pxGrid Direct Dictionary
From ISE, navigate to Policy > Policy Sets > Select a Policy Set > Authorization Policy. Click the gear icon in any of the Authorization Policies and Select Insert.
Give a name to the rule and add a new condition to open the Condition Studio.
Click to add a new attribute, navigate to Unclassified, and under Dictionary filter by the name of the pxGrid Direct Connector.
Select an attibute that can be proccessed under an Authorization Policy, and set the vaule. Click Use.
Select the Profile as the result of the condition. Click Save.
Test the new rule. Ensure the RADIUS Live Log Details of the endpoint and the value of Authorization Policy is the same as the Rule Name with the pxGrid Direct Connector attributes.
From ISE, navigate to Operation > Troubleshoot > Debug Wizard > Debug Log Configuration. Select your Primary Admin Node (PAN) and click Edit.
Filter the Component Name by pxGrid Direct and select the Log Level needed. Click Save.
On ISE GUI, navigate to Operations > Troubleshoot > Download Logs > Select ISE PAN > Debug log > Debug Log Type > Application Logs. Download the zip files for pxgriddirect-service.log and pxgriddirect-connector.log.
The logs for pxgriddirect-service contain information related to whether fetched endpoint data has been received and saved to the Cisco ISE database.
The logs for pxgriddirect-connector contain information that indicate whether a pxGrid Directed connector is successfully added to Cisco ISE.