Cisco ISE has several capabilities to manage endpoints with one of them being the ANC (Adaptive Network Control). By using ANC, an administrator can Quarantine, Shutdown, or Port Bounce an offending host (for example, malware, APT, viruses, or vulnerabilities). With beSECURE, Cisco ISE can impose a Quarantine on a host with specified number of high-risk vulnerabilities or whose overall Score (security posture) is below a certain value.


Configuring Cisco ISE to integrate with beSECURE

To integrate Cisco ISE with beSECURE, you must enable ERS (Endpoint RESTful Service), create a dedicated beSECURE user (or assign an existing administrator), and create an Active Network Control (ANC) policy in Cisco ISE.

To enable ERS, do the following: 

  1. Connect to Cisco ISE.
  2. Select Administration > System > Settings > ERS Settings.
  3. Select Enable ERS for Read/Write.

To create a dedicated beSECURE user, do the following:

Note: You can also use an existing administrator for this purpose.

  1. Select Administration > System > Admin Access.
  2. In the left side menu, select Administrators > Admin Users.
  3. Select Add > Create an Admin User.
  4. On the New Administratorpage, do the following:
    1. In the Name box, enter beSECURE.
    2. In the Password boxes, enter a password.
    3. For Admin Groups, select ERS Admin.
  5. Select Submit.


To create an ANC policy, do the following:

  1. Select Operations > Adaptive Network Control > Policy List.
  2. Select Add.
  3. In the Name box, enter beSECURE.
  4. In the Action box, add Quarantine.
  5. Select Submit.


Configuring beSECURE to integrate with Cisco ISE

To integrate beSECURE with Cisco ISE, do the following:

  1. Log in to beSECURE.
  2. Select More > Server > Integration.
  3. Select Cisco ISE.
  4. Enter your Cisco ISE URL, Username, Password, and beSECURE ANC Policy in the boxes provided.
  5. For Triggering Criteria, enter the number of High-risk vulnerabilities and/or host score values, based on your needs. Whenever a scan completes, the results of the scan are analyzed to determine whether a Cisco ISE should be altered because a host is exceeding the allowed number of High-risk vulnerabilities or has a score below or equal to the provided values. This example uses 5 and 25, but you can use one or both options.
  6. Select Save.


Viewing active policies in Cisco ISE

To view Policies that are currently active (and remove them if needed), do the following:

  1. Select Operations > Adaptive Network Control > Endpoint Assignment.
  2. Select the host you want to unquarantined and then delete it by either selecting Trash or EPS unquarantine, and then entering the IP address or MAC address of the endpoint.