CloudGuard Controller for Cisco Identity Services Engine (ISE)
The CloudGuard Controller Provisions SDDC services as Virtual Data Centers that provide virtualized computer networking, storage, and security. integrates Cisco ISE Cisco® Identity Services Engine. Provides highly secure network access to users and devices to streamline security policy management and reduce operating costs. Trademark of Cisco. with Check Point security.
It allows the use of TrustSec Security Groups in the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. according to the static IP-to-SGT mappings in ISE.
The ISE server is represented as the Data Center Virtual centralized repository, or a group of physical networked hosts, Virtual Machines, and datastores. They are collected in a group for secured remote storage, management, and distribution of data. server in Check Point.
It connects to the ISE administration nodes and automatically retrieves object data.
For redundancy, it is possible to provide both primary and secondary ISE administration nodes.
The ISE External RESTful Services (ERS) API enables communication with ISE.
Prerequisites
-
Cisco ISE version 3.2
-
An ISE administrator with the ERS-Operator or ERS-Admin group assignment
-
ERS enabled on the ISE administration nodes
Connecting to a Cisco ISE Data Center
Step |
Instructions |
---|---|
1 |
In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., create a new Data Center object in one of these ways:
|
2 |
In the Enter Object Name field, enter a name. |
3 |
In the Hostname(s) field, add the ISE administration Node(s) IP address or hostname. |
4 |
In the Username field, enter the ISE administrator username. |
5 |
In the Password field, enter the ISE administrator password. |
6 |
Click Test Connection. |
7 |
Click OK. |
8 |
Publish the SmartConsole session. |
9 |
Install the Access Control Policy on the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object. |
Cisco ISE Objects and Properties
Cisco ISE Imported Objects
Object |
Description |
---|---|
Security Groups |
Groups of users, endpoints, and resources that share Access Control policies. You define the Security Groups in Cisco ISE. |
Automatic Failover
If there is a failure to communicate with the provided ISE administration nodes, CloudGuard Controller enters a recovery mode. In recovery mode, it automatically attempts to establish the connection again with the administration nodes. Connection is attempted with the nodes based on the order they were entered.
|
Important - Make sure that the secondary node is correctly synchronized with the primary node. If not, the IP-to-SGT data may not be up to date. |