Skip to content

Create a new Cisco ISE machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Creating a machine for Cisco Identity Services Engine (ISE) lets Certificate Manager - SaaS discover and provision the system certificates on the nodes of your ISE deployment. You connect the machine to the Primary Policy Administration Node, and Certificate Manager - SaaS reads the deployment's node list from it, so one machine covers the whole deployment. After you create the machine, you can provision certificates to it.

Before you begin

  • The hostname, fully qualified domain name (FQDN), or IP address of the Cisco ISE Primary Policy Administration Node.
  • The port the Cisco ISE Open API listens on, if it isn't 9070.
  • At least one active VSatellite connection that can reach every node in the deployment on the Open API port. Provisioning connects to each node directly, at the FQDN or IP address that the node reports to the deployment.
  • The Open API turned on for every node in the deployment. In the Cisco ISE admin portal, select Administration > System > Settings > API Settings. The Open API is off by default on ISE 3.1 through 3.3. If it's on only for the Primary Policy Administration Node, discovery succeeds but provisioning to the other nodes fails.
  • A Cisco ISE administrator account that belongs to the ERS Admin group or has the Super Admin role. To create or choose the account, select Administration > System > Admin Access > Administrators > Admin Users. This access lets Certificate Manager - SaaS read certificates on all nodes, import certificates, and change the services a certificate is assigned to.

Note

Certificate Manager - SaaS doesn't verify the Cisco ISE server certificate when it connects to the deployment. The connection is still encrypted.

  1. In Hostname or IP Address, enter the hostname, FQDN, or IP address of the Primary Policy Administration Node.

  2. In Port, enter the port the Cisco ISE Open API listens on. The default is 9070.

  3. For Credential Type, choose one of the following:

    • Enter Credentials to enter the Cisco ISE administrator username and password.
    • Select Credentials to use shared credentials from CyberArk.

    Note

    Credential types require additional licensing. Only users with the CyberArk shared credential capability see this option.

    Important

    Your role can limit which credentials you see. System Administrators and PKI Administrators can select any credential. Users with the Resource Owner role can use only the credentials that belong to their teams.

  4. Enter the credentials for the method you chose:

    • If you chose Enter Credentials, enter the Username and Password of the Cisco ISE administrator account.
    • If you chose Select Credentials, for Credential, choose the shared credential that holds the administrator username and password. The stored account needs the same Cisco ISE access as an account you enter manually.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  5. Click Test Access, then click Continue. Continue is enabled only after the test succeeds.

    Note

    A successful test confirms that Certificate Manager - SaaS can reach the Primary Policy Administration Node and that Cisco ISE accepts the credentials. It doesn't confirm that the Open API is on for every node or that VSatellite can reach every node.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling. Discovery scans every node in the deployment. To skip certificates that have already expired, enable Exclude Expired Certificates when you configure discovery.

For existing machines: