Cisco ISE Integration

Versus connects to Cisco Identity Services Engine (ISE) — the AAA and network-access-control authority for most Cisco estates — so identity context becomes part of network automation instead of a separate console. From a workflow, the AutoPilot, or the Integrations page you can answer who is behind this IP or MAC right now, which switch port and VLAN did they land on, which network devices AAA against ISE, and, when the situation calls for it, re-authorise, disconnect or quarantine an endpoint with a Change of Authorization.

The integration is read-first: every lookup is a plain API read, and the three write actions (CoA re-auth, CoA disconnect, endpoint-group move) are ordinary SDK calls you place behind an approval gate in a governed workflow.

---

How it connects

A Cisco ISE source in Versus points at one ISE deployment's Primary Administration Node (PAN) and uses three ISE APIs behind one client:

Authentication is HTTP Basic with an ISE admin account. Give it the smallest role set that covers what you use:

• ERS Operator for read-only ERS access, or ERS Admin if workflows will move endpoints between groups.
• MnT Admin for live sessions and CoA.

ERS is off by default on a fresh ISE: enable it under Administration → System → Settings → API Settings ("Enable ERS for Read/Write"). The Open API is switched on in the same place on ISE 3.1 and later.

The password is write-only and encrypted at rest — it is never returned by the API, and editing a source lets you leave it blank to keep the stored value. See Security & Compliance.

Fields

Test checks ERS first (it counts network devices), then adds the MnT product version and active-session count when available, and records the deployment nodes on the source.

---

What you can see

Open Integrations → Cisco ISE → Explore on a source. Every tab shows whether the data is Live from the deployment or, for a seeded demo source, Sample data.

• Deployment — every node with its roles (PrimaryAdmin, PolicyService, …), services and status, plus counts of network devices, endpoints, sessions and security groups.
• Network Devices — the NADs registered in ISE: management IPs, location and device-type groups, RADIUS / TACACS+ / SNMP settings. F5 BIG-IPs, NetScalers and firewalls that authenticate admins through ISE Device Admin show up here alongside switches and WLCs.
• Endpoints — MAC-keyed endpoint records with their endpoint identity group (quarantine and blacklist groups are highlighted), profiler policy and identity store.
• Live Sessions — who is on the network right now: user, MAC, IP, network device and port (or SSID and VLAN), authentication method, authorization profile, SGT, posture and session start. Each row offers re-auth, disconnect and quarantine actions.
• TrustSec — security group tags with their numeric values, and the identity groups policy refers to.
• Policy Sets — network-access policy sets with state, service and hit counts (Open API, ISE 3.1+).

---

Using it in workflows

The Python SDK exposes ISE as versus.integrations.ise() — the first enabled source, or versus.integrations.ise('Corp ISE') by name. Reads:

ise = versus.integrations.ise()

# who is behind an address right now
s = ise.session(ip='10.20.14.91')          # or mac='F4:5C:89:D2:6E:40', user='praman'
if s:
    versus.log(f"{s['user']} on {s['network_device']} {s['nas_port']} "
               f"authz={s['authz_profile']} sgt={s['sgt']} posture={s['posture']}")

# which NAD owns a management IP (is this switch even registered in ISE?)
nad = ise.find_network_device('10.10.1.2')

# broader inventory
nads      = ise.network_devices(q='tor-')
endpoints = ise.endpoints(q='DC:A6')
sgts      = ise.sgts()
nodes     = ise.nodes()

Actions — place these after a core.approval step in a governed workflow:

ise.coa_reauth('DC:A6:32:1F:77:03')                     # re-run authorization
ise.coa_disconnect('DC:A6:32:1F:77:03')                 # drop the session
ise.set_endpoint_group('DC:A6:32:1F:77:03', 'Contractors')
ise.quarantine('DC:A6:32:1F:77:03')                     # → Quarantined_Systems + CoA re-auth

quarantine() is the building block for a containment loop that pairs with the CrowdStrike integration: a detection names a host, ISE resolves its live session, the endpoint is moved to the quarantine group and re-authorised so the switch or WLC applies the remediation VLAN / SGT immediately, and the change is written back to the ticket. The Generate with AI button in the Workflow Builder knows these methods, so "quarantine the endpoint behind IP X after approval" produces a working workflow.

Session shape

session() and sessions() return the same dictionary:

---

In the AutoPilot and Support Copilot

Two read-only expert tools are available to the Diagnostics AutoPilot and to agents that inherit its toolbox:

• ise_session — the live session behind a MAC, IP or username (user, port, SGT, authorization profile, posture).
• ise_network_device — the NAD registered for a management IP or name.

A path-check that ends at "the client cannot reach the VIP" can now continue with "the client is on mtl-access-sw-14 Gi1/0/7 in the Unknown_Device_Redirect profile — it never passed 802.1X", which is usually the actual answer.

---

Demo source and sample data

Running manage.py seed_cisco_ise_demo (or the full seed_demo) creates a Cisco ISE (Demo) source flagged as a demo. It answers from a representative sample deployment — four nodes, eight network devices (including the demo F5s and firewall as TACACS+ clients), ten endpoints, twelve live sessions including one quarantined contractor laptop, seven SGTs and five policy sets — so the surface is demonstrable before a real PAN is connected. Actions on the demo source are simulated and say so.

Real sources never fall back to sample data: if ISE cannot be reached, the tab, the SDK call and the AutoPilot tool report the error.

---

Notes and limits

• ERS list calls are paginated at 100 objects; Versus follows nextPage up to 500 objects per read and fetches per-object detail for the first 100 (ERS lists return only id/name).
• MnT session APIs answer XML; Versus normalises them to the dictionary above. TACACS+ admin sessions have no MAC and therefore no CoA.
• CoA needs a Policy Service Node: Versus uses the session's own PSN, then the source's Default PSN. If neither is known the call fails with a clear message rather than guessing.
• Open API endpoints (deployment nodes, policy sets) need ISE 3.1 or later; on older releases Versus falls back to ERS for nodes and reports policy sets as unavailable.
• Every API call goes out from the Versus server (or the site's collector when the PAN is only reachable on-prem). Allow TCP 9060 and 443 from that address to the PAN.

Related

• CrowdStrike Integration — endpoint detections that pair with an ISE quarantine
• Diagnostics AutoPilot — where the ise_session tool lives
• Workflow Builder — approval gates around the CoA actions
• Pager / On-Call Integration — page the identity team from the same workflow