Cisco Identity Services Engine offers robust authentication, posture profiling, guest and secure access, and dynamic policy management. Known for its seamless integration with Cisco tools and network access control features, it ensures secure device and user authentication across networks.
| Product | Mindshare (%) |
|---|---|
| Cisco Identity Services Engine (ISE) | 18.5% |
| Aruba ClearPass | 17.8% |
| Fortinet FortiNAC | 11.7% |
| Other | 52.0% |
| Company Size | Count |
|---|---|
| Small Business | 34 |
| Midsize Enterprise | 23 |
| Large Enterprise | 70 |
| Company Size | Count |
|---|---|
| Small Business | 770 |
| Midsize Enterprise | 393 |
| Large Enterprise | 913 |
Cisco Identity Services Engine is renowned for its capabilities in managing authentication, guest access, and policy management through segmentation. Its TrustSec functionality, alongside RADIUS and TACACS+ support, provides enhanced security, further augmented by its ability to operate in diverse environments. Its scalability and integration with Cisco solutions aid in maintaining network visibility and access control. Challenges include the complexity of initial deployments, somewhat cumbersome documentation, and limited integration in multi-vendor environments. While encountering issues in stability and updates, the demand for better analytics and straightforward troubleshooting alongside cost-effective licensing is notable.
What are the key features of Cisco Identity Services Engine?Industries implement Cisco Identity Services Engine primarily for network access control, ensuring secure authentication and segmentation in both wired and wireless environments. Supporting policies like bring-your-own-device and compliance standards, ISE manages identity-based access control, especially beneficial for entities that require detailed user rights management and integration within enterprise networks.
Cisco Identity Services Engine (ISE) was previously known as Cisco ISE.
Aegean Motorway, BC Hydro, Beachbody, Bucks County Intermediate Unit , Cisco IT, Derby City Council, Global Banking Customer, Gobierno de Castilla-La Mancha, Houston Methodist, Linz AG, London Hydro, Ministry of Foreign Affairs, Molina Healthcare, MST Systems, New South Wales Rural Fire Service, Reykjavik University, Wildau University
| Author info | Rating | Review Summary |
|---|---|---|
| Service Line Manager (Service Operations Expert) - Network Access Control at a pharma/biotech company with 10,001+ employees | 2.0 | I use Cisco Identity Services Engine (ISE) mainly for wireless authentication and device administration. While it excels in device administration, it falls short in network access control. It offers cost savings compared to Forescout but needs improvements in threat detection and profiling. |
| IT Network Manager at a tech services company with 10,001+ employees | 4.5 | I find Cisco ISE reliable and easy to use for RADIUS authentication and guest access, though log capacity and stability during upgrades could improve; overall, it integrates well with our Cisco environment and meets our needs effectively. |
| Ag. Systems & Networks Head at UNBS | 4.0 | We use Cisco Identity Services Engine for network access control to isolate devices and enforce rules, enhancing visibility and security. However, integration with other vendors can be restrictive, needing workarounds. I've considered Juniper and D-Link switches. |
| Senior Network Engineer at Shabkati network solutions | 4.0 | I primarily use Cisco Identity Services Engine (ISE) to enhance network security through endpoint segmentation and automation. While its integration and scalability are valuable, the licensing and pricing need improvement. Alternatives like HPE ClearPass and Fortinet were only considered comparatively. |
| Technical Services Lead at Telenet Solutions | 4.5 | We use Cisco Identity Services Engine (ISE) for network access control, including LAN, WAN, and Wi-Fi. It enhances security through RADIUS authentication. However, hardware compatibility is limited outside Cisco products. The solution provides ROI by improving security and reducing downtime. |
| Manager Network Operations at RAND Corporation | 5.0 | We use Cisco ISE for various authentication tasks, benefiting from its unified interface and policy management. While its documentation needs improvement, it significantly saves us money. Alternatives, like Microsoft, lacked maturity, and Linux required sysadmin expertise. |
| Network Engineer at a financial services firm with 10,001+ employees | 4.5 | I use Cisco Identity Services Engine for AAA authentication, enabling AD login with a single username. While the solution simplifies management and access, the web UI requires improvement for better navigation, specifically in the left pane after updating to version 3.1. |
| Network Architect at Great Canadian Gaming Corp | 4.5 | We primarily use Cisco ISE for device authentication and are integrating 802.1X for enhanced security. It efficiently authenticates wired users and separates guest networks, although policy implementation could be streamlined. We've experienced a positive ROI through improved protection. |
| Senior Cyber Security Engineer at Beta Information Technology | 4.0 | I design and implement Cisco Identity Services Engine for network access control, utilizing features like TACACS for device administration. Despite facing numerous bugs, the vendor actively works on improvements via new patches and hotfixes. |
| VP of Technical Architecture at Logicalis | 5.0 | The Cisco Identity Services Engine (ISE) offers valuable features for endpoint onboarding, authentication, and user authorization, but needs improved virtual integrations. While immediate ROI is unclear, its integration within Cisco's portfolio provides significant benefits over competitors. |
Cisco Identity Services Engine (ISE) is very good at device administration. This is one of the best features. Other than that, for the wireless authentication and network access control (NAC) use cases, it is not a solid product because there are better products for NAC than Cisco Identity Services Engine (ISE).
Cisco Identity Services Engine (ISE) needs to improve the profiling preauthentication. They are very poor in asset classification and should focus on improving the preauthentication profiling, especially for NAC use cases. This will give them a roadmap for software-defined access (SDA) use cases and network segmentation. Threat detection capabilities are very weak. Additionally, the product is vulnerable and has many bugs.
I have been working with Cisco Identity Services Engine (ISE) for around four years or more.
The stability of Cisco Identity Services Engine (ISE) is poor for certain use cases, like authentication. Device administration runs smoothly. Authentication and NAC use cases do not. I would rate the stability as four out of ten.
Scalability is limited. Factors like architecture, business nature, and legal limitations such as GDPR affect it. I would rate it as four or five out of ten.
Technical support is poor. It heavily relies on a reactive approach, and resolving issues can take a long time. Simple issues can take 72 hours or more than six months for resolution. I rate the technical support as one out of ten.
Negative
We also use Forescout. We use both Cisco Identity Services Engine (ISE) and Forescout simultaneously.
The initial setup is challenging. For enterprises, it can take months due to VM setup requirements, poor tech support, and Cisco Identity Services Engine (ISE) having many bugs. Small setups might take a day, but larger enterprise setups are much longer.
Cisco tech support and professional services are poor, lacking clear requirements and solutions.
The return on investment for Cisco Identity Services Engine (ISE) is difficult to gauge due to complexities. For enterprise customers, it comes at a lower cost and is comparatively cost-effective. Direct comparisons with Forescout reveal up to 30% to 40% difference in cost savings.
Setup costs vary. Cloud solutions are expensive, while on-prem setups with shared environments are cheaper but not effective. Dedicated resources are needed due to the demanding nature of Cisco Identity Services Engine (ISE), making large organizational costs significant.
For small organizations, it's effective - not for larger ones.
We have evaluated and used Forescout alongside Cisco Identity Services Engine (ISE).
For small setups and if the backend infrastructure is Cisco-based, Cisco Identity Services Engine (ISE) is suitable. However, for large organizations with mixed infrastructure, other solutions should be considered. I would rate it four out of ten based on my experience from the last year.
I am working with switches, wireless, and SD-WAN solutions, but regarding the opinion itself, it depends what one would like to get.
For what we do, the most useful feature in Cisco Identity Services Engine (ISE) is RADIUS authentication. We are using the guest portal as well, the Wi-Fi guest portal capability from Cisco Identity Services Engine (ISE).
The Wi-Fi guest portal feature allows us to give access to non-company devices on the locations we have for visitors.
We use the Cisco Identity Services Engine (ISE) profiling feature to onboard new devices whenever they're connected and assign them the correct profiles. It was mostly used when the ISE was deployed, but it's still used.
The adaptability of Cisco Identity Services Engine (ISE) policy enforcement can fit to the site we have depending on which kind of devices we have on site and then the needs for authentication, granting access and then assigning each device into its correct network for segmentation.
For what we're doing so far, it's quite easy for us; we are not doing too much complicated stuff, so it's quite easy for us to onboard a new site into the current policy we have.
The most useful feature in Cisco Identity Services Engine (ISE) is RADIUS authentication. We are using the guest portal as well, the Wi-Fi guest portal capability from Cisco Identity Services Engine (ISE).
The Wi-Fi guest portal feature allows us to give access to non-company devices on the locations we have for visitors.
We use the Cisco Identity Services Engine (ISE) profiling feature to onboard new devices whenever they're connected and assign them the correct profiles. It was mostly used when ISE was deployed, but it's still used.
The adaptability of Cisco Identity Services Engine (ISE) policy enforcement can fit to the site we have depending on which kind of devices we have on site and then the needs for authentication, granting access and then assigning each device into its correct network for segmentation.
For what we're doing so far, it's quite easy for us; we are not doing too much complicated stuff, so it's quite easy for us to onboard a new site into the current policy we have.
Cisco Identity Services Engine (ISE) has simplified guest access management for us without compromising security for our organization.
The log capacity in Cisco Identity Services Engine (ISE) could be enhanced because today natively on the ISE can only have a look at the logs from the day before. You cannot search into the oldest logs; you have to use another tool for that. This can be blocking if you don't have any log consolidation solution. To do a search for an issue or something that happened two days ago, you cannot search directly in there.
The capacity of Cisco Identity Services Engine (ISE) could be enhanced.
Something between one week and one month for the log capacity would be nice.
Sometimes when we have upgrades or failovers with Cisco Identity Services Engine (ISE), we had some minor issues. It took something around two or three days before it came back to a stable situation.
For the size of our company, Cisco Identity Services Engine (ISE) is a scalable solution. It's working fine.
It's working fine because we are using many other Cisco products, so the interaction between Cisco tools is fine. However, you can have some latency issues depending on where your devices are. We don't have many devices spread on other geographies than EMEA; we have some of them in APAC, but for a really big deployment, scalability could force you to deploy more complex architectures. In this case, that would be the only drawback.
I have contacted Cisco support.
Their support is really good. Cisco support has pretty good teams for support and every time we had good answers and we could somehow solve the issues we had.
Positive
The setup of Cisco Identity Services Engine (ISE) was done by a third party, by a subcontractor. It would be hard for me to tell you how easy or not it was because the person was used to deploy this product already, but it wasn't that long, so we migrated from the previous environment to the current one we are using. Deployment or upgrade was quite acceptable.
Setup and migration of Cisco Identity Services Engine (ISE) took something around two weeks because this one is handling all the authentication we have worldwide. We took our time to make sure that migration was fine and we also merged. We had separated ISEs before, so we merged into a consolidated one, which is why it took more time.
I haven't faced any other kind of issues or difficulties with Cisco Identity Services Engine (ISE).
The biggest benefit of Cisco Identity Services Engine (ISE) as a product for me is that it is stable and reliable.
On a scale of 1-10, I would rate Cisco Identity Services Engine (ISE) a 9.
We use it for network access control.
It isolates the bring your own devices and the guests from the corporate network. It also segregates connections when a user comes in and connects. There is a certain profile review that goes on to confirm that the device is allowed to access resources on the network.
The policies allow us to enforce certain rules on the network to be able to screen our users more effectively. It allows us to have more visibility to what the users are trying to do on the network, which really helps us know how to control them.
There is value because it helps us secure the network and prevents certain things from happening which could cause financial loss. This demonstrates good value for money.
They should make their integrations with other manufacturers less restrictive. They should work on their integration with other vendors.
The integrations with the switches and the wireless controllers are not really straightforward. There is what they call the best practice for them, but it may not be what we have on-premise. We have to find a workaround with certain configurations to make them work.
We have been using the solution since 2021.
It works and does what it is supposed to do. It is stable.
It is pretty scalable.
We have used customer service.
Positive
I have not used any previous solutions and am not sure about others.
It is a bit complicated. The implementation took us about two months.
It is deployed on-premises.
I have not compared with other vendors, but the license is reasonably priced.
The cost is about 100 million Ugandan shillings, which converts to approximately $30,000 per year.
I have considered trying Juniper and D-Link switches.
I am only using the Cisco Identity Services Engine (ISE) and the switches. Higher licensing is required for additional features. I rate this solution 8 out of 10.
The primary use case of Cisco Identity Services Engine (ISE) is to serve as a security solution that can specify the endpoints in an organization for segmentation. This involves defining the reachability domain for each endpoint in an organization.
It automates pushing access lists or authorizations and offers profiling to define and manage endpoints. It provides profiling to help organizations define the type and points of the endpoints, building security rules, and providing health checks to ensure endpoints comply with rules.
The solution offers automation and real-time visibility, which aids in monitoring and troubleshooting issues with endpoints.
The product provides feedback about the network based on endpoint behavior, assisting in understanding the network's current state.
The solution is integrated with other Cisco devices and can offer automation for an organization, making deployments more dynamic and providing real-time visibility. It gives feedback on what is happening within the network and assists mostly with troubleshooting.
Additionally, it's considered highly reliable and scalable.
The licensing scheme is complex and could use enhancement to provide more options. Pricing can be more expensive compared to other vendors, and there is a significant price gap observed, which doesn't seem justified by some specific features. The complex licensing schema and the need for improvement in pricing are primary areas for improvement.
Cisco Identity Services Engine (ISE) is considered very reliable and stable. Although it is not one hundred percent reliable theoretically, in practice, it offers great reliability.
The solution is described as very scalable, and there are minimal issues with scalability.
Sometimes it's challenging to identify which support team is responsible for certain issues, which is a significant concern.
Positive
Setup is not about deploying ISE itself, but rather about managing the number of switches and endpoints in the organization. After initial deployment, routine upgrades and backups are part of the normal process.
A specific implementation team is not mentioned, but deployment complexity varies depending on the organization size and manpower available.
Cisco ISE is more expensive but covers a lot of features. The pricing scheme could be improved. Compared to other solutions like HPE ClearPass, Cisco is more costly, and the conversation suggests a possible forty percent price gap compared to competitors.
Detailed mentions of other solutions include HPE ClearPass and Fortinet. However, these are mentioned for comparison purposes rather than as alternatives considered before using Cisco ISE.
It is suggested to keep the review anonymous and refrain from making personal information public.
I'd rate the solution eight out of ten.
Positive
We use the product for TACACS, dot1x, authentication for some of our RADIUS devices, and authentication and authorization for our VPN clients.
We've become more secure. We see devices that lose certificates, and then they get denied. Before, we would only get to know that the network was down. Now, with the help of the solution, we can pull up reports, go through them and understand that the certificate has expired. So, the person who raised the ticket takes the certificate, and everything gets resolved.
We can also understand if posturing fails because the user doesn't have the current version of the software on. The product provides us with one place to look for all of these noncompliance issues. If a port keeps locking down, we can send somebody to check the devices and remove a bad device if needed. The issue doesn’t get on the network because the product ties in and locks the network down for us on that port.
Cisco ISE Identity Services Engine enables us to do everything from one interface. It makes it easy to work with top-down policies, to configure groups or the granularity we control in our dot1x environment and posturing. The product helps the granularity our InfoSec group wants to achieve within their posturing project.
They should improve the documentation. There tends to be a lot of old text, or the new things aren't always up to what's been released on the code, and sometimes the documentation is inconsistent.
Last week, we were doing a dot1x troubleshooting, and I was showing people how to look for it, and all the documentation came up for version 1.0. I wondered why version 3.0 is not the top choice since it is already out, and we've been on Version 2.0 for five years. The solution should try adjusting their tags because sometimes it's difficult to find things.
I have been using the solution since version 1.1.2 was released.
I haven't found another support group that I've been able to call that gets me where I need to be as quickly. Our account manager is great. He gets on the phone with support if we ever have an issue. Unlike other organizations, Cisco has been a trusted partner. Support has quick turnarounds. The quality of support depends on the subject we need help with.
Positive
Just getting the solution up and running was quick. Getting it to do what we wanted took us about six months. I didn't take class for it. I had the documentation to go with, but it was version 1.0.
The product has helped us save money drastically. We were able to get rid of two different service contracts. We could invest more into the solution or into people that can help us administer it. So it's been nice. We save quite a bit of money getting rid of those other products.
The solution’s pricing is reasonable. For everything that it does, it's actually great. It's part of our Security Enterprise Agreement. So, we get guaranteed pricing for the length of the agreement, including upgrades. It's worth it. There are no hidden costs with Cisco.
We looked at Microsoft, but the product was too immature. We also looked at a Linux product. The networking team told us that we have to be sysadmins to run it. It didn't do something we needed it to do.
We had looked at other products, but the mesh Cisco products have with their devices makes it more seamless. If I'm having a problem with a device, it is good to have everything from a single vendor to solve issues quickly.
A lot of the apects that needs to be improved in the product has already been done in the 3.0 version, including HTML5 and integrations with other cloud products like Azure and Intune. I just haven't upgraded yet. They are doing a good job of keeping up with new technologies. I have a small team, and it's hard to keep up with products.
With our dot1x, we've seen situations where people have inadvertently plugged their own PC into the port, and the port shuts down. We instantly know that the port got shut down. It's been great. I haven't found another product that can do it as well and as easy to set up as the implementation of dot1x.
The solution has freed up the IT staff’s time a little bit, but it also created more work in a good way. It has created more work in Cisco because now we're doing segmentation. We're taking dot1x to the next level and closer to moving towards a zero-trust network. The Cisco team gets access to the servers after authentication.
We've done a lot of research on zero-trust networks. I work for a research company, and we've been looking at ways to do it. Historically, we have done segmentation by identifying groups of servers and locking them down. This process is challenging to manage. While setting up micro VLANs, we can provide role-based access instead of just putting applications on server pools and wondering who gets what access. If user A needs to be able to update their personal information because they got a new phone number, they need access to the HR system to do that. The HR people need to be able to see all their review records. However, user C doesn't need to see anything that user A is doing. That is what we are looking for. We want zero trust so that an individual has access to what that individual needs to be able to do and nothing more and nothing less.
We had been running two other RADIUS servers just because they worked better with the product that we brought in. Cisco Identity Services Engine is more configurable, especially on ports. So, we were able to get rid of the other two RADIUS servers. We don’t have to pay service contracts for them, and there are no more upgrades. Now, we have one suite that we focus on.
The mean time for issue resolution has drastically reduced. Everybody's looking at the same pane, the network team and InfoSec. As soon as they see something blocked, if we're not already investigating it, they're investigating it. We get to share the responsibility with multiple groups with the same end goal. It has tied the team together and made things a lot easier.
I have a small team. I have seven sites and seven people. And if I applied one person to each one, we could watch it. Our InfoSec group, who's watching all their logs from the external firewalls, would watch that. With Cisco Identity Services Engine, we must have saved 100s of hours over the year. If something comes up, two groups almost instantaneously open a chat and start working on it. We know that our escalations are blocked on time. The amount of cleanup that we've had to do from malicious devices is down to almost nil.
The solution has helped our organization to improve its cybersecurity resilience. We see malicious or unknown devices and react to them. We see known devices come in with outdated software. Everything gets addressed as soon as the user connects. It all comes together.
Spend some money on classes and not on just who you think is going to lead your project. Get your whole team involved. If you are from the networking side, ensure your InfoSec team is included, and vice versa. The tool has so many capabilities that you will feel overwhelmed, but it becomes easier once the pieces start coming together.
We had two other RADIUS servers. When we moved to Cisco Identity Services Engine, we were on Cisco ACS. Not many people offer the granularity that Cisco does because it's the main protocol for authenticating on devices.
Cisco SD-WAN’s support still needs more learning. Cisco ThousandEyes started the same way. They have improved in the last two years. They're up to an eight out of ten now. Before, I didn't even want to talk to them. We love the product.
We're expanding our cloud and looking at deploying the product on a hybrid cloud. However, we've got to get done with SD-WAN first.
Overall, I rate the solution a ten out of ten.
I use the product for AAA authentication.
Before, we used to use Cisco ACS. After ACS retired, we started using Cisco Identity Services Engine. Right now, we are integrating Cisco Identity Services Engine with DNAC. Whatever we provision inside DNAC will send the information to Cisco Identity Services Engine, and the switch will be added. This process enables easy management.
The solution enables us to authenticate with AD. That way users can log in with one username to the product and access the router and switches.
The web UI should be made similar to the one in DNAC. The left pane must have the menu title followed by the submenu. Since I have moved to version 3.1, I have to go back to the old version to figure out my way. They haven't improved the left pane of the UI. The left pane is supposed to have the menu title in order.
I have been using the solution for at least seven to eight years.
So far, I have no issues with the solution’s stability. My primary and secondary systems are working fine. I have the least to worry about. It has run smoothly for seven years.
We are using the product in about 500 devices in our organization.
We have Platinum Support. When we call, everything gets through. I have no problems with support. However, if someone does not have Platinum Support, they will have to wait for probably an hour or two. I usually get a response in less than 30 minutes when I open a ticket because we pay for it.
I am 98% happy with the support. Sometimes, I am unhappy when we have an incident and need quick support, but the support manager asks too many questions. I prefer fixing the problem in real time and then answering questions. Fixing the problem is more important than answering questions. When I talk to the engineer, they ask questions on how it has impacted our network. They must fix my problem first. I can answer all their questions later.
Positive
We have a contractor who implements the product for us. After that, they give it to me to manage. Upgrading from version 2.7 to 3.1 is easy. So far, it's good. The contractor's name is Deytek. I just provided the ACS server information from the previous server to the contractors. Then, we purchased the on-premises hardware, migrated it, and started using it. I didn’t have to do anything. It was easy for me.
The upgrade from version 2.7 to 3.1 was a little bit hard, and I had to prepare a lot to do it. We need to plan the process well. We cannot just decide to upgrade the tool without planning. We had to plan with the help of AS services, who guided us on the steps to do and the backup needed. They guided us to upgrade the secondary unit first and then the primary. I also had to talk to our corporate team in Boston. We had to inform our ISA Server team about the upgrade because once you upgrade, tools that are not authenticated might lose connection.
The solution helped me by making my job easier. I manage and deploy the solution. All the other users have to do is log in and look at what they need to do. The product makes it easy for me to manage and enables the end users to log into other systems.
The pricing is complicated. The solution uses Smart Licensing. I had to go through a lot of phone calls to convert my old license to the new one and make it work. It took me about three weeks to figure out my licensing model and why mine was different from the other teams. It's good because Cisco Identity Services Engine will automatically get our licenses from one location. It would be better this way.
The product provides an email notification if anything is detected. We set up ACL policies based on which the product would alert us through emails if anything major happens.
The solution helped me give access to many people who use Cisco products, either router switches or UCS, from other teams. Instead of creating every ACL on the tool, I only need to set up AD group permission and add their username for them to access the same policy.
I do not use the cybersecurity features of the tool much. We only use the solution for AAA authentication. I need to explore the other features we seldom use. We are upgrading to version 3.1. We recently signed a contract with Cisco Advanced Services. They might provide us with more information to use the tool in my company.
Since I joined my current organization, we have used Cisco for everything. We have deployed the tool primarily in one location, and the secondary one is 5000 miles away in another location. One tool is in California, and the other is in New York.
I implemented version 3.1 just two months ago. I need to learn more about it and enable more features on my network. I need to improve myself to learn more because version 3.1 has a lot of new features.
Overall, I rate the product a nine out of ten.
We mainly use Cisco ISE for device authentication. We are now rolling out 802.1X.
Cisco ISE has provided us with a security posture that we desire, particularly for wired connections, enabling the identification of domain users and non-domain users.
I would rate Cisco ISE an eight out of ten for its capability to secure our infrastructure from end to end, enabling us to detect and address threats. This high rating is due to its ability to establish policies and dynamically configure switch components for users.
Cisco ISE has helped our IT staff save approximately 15 hours per week, as they no longer need to manually configure the switch components.
Cisco ISE has helped improve our cybersecurity resilience, particularly through the use of 802.1X. This aspect is something we are leveraging to a great extent.
Being able to authenticate wired users through 802.1X is valuable as it enhances our security. If someone enters an unsecured room and connects to a wired connection, they will be authenticated to a guest network, completely segregated from our data networks.
The policies could be adjusted to make them more easily implementable.
I have been using Cisco ISE for four years.
Cisco ISE is extremely stable.
Cisco ISE is highly scalable, particularly for device authentication, as we have 3,000 switches in our environment.
Cisco technical support was knowledgeable about Cisco ISE deployments.
Positive
The initial setup was straightforward because we were familiar with what we wanted. When we encountered an issue with the policies, we opened a task case, and it was resolved quickly.
We utilized an internal consultant for the implementation who possessed extensive experience in Cisco technology. Our overall experience was positive.
We have witnessed a return on investment with Cisco ISE due to the protection it offers to our environment and the capability of 802.1X to assist in managing security risks.
I give Cisco ISE a nine out of ten.
Cisco is continuously improving its products. There are so many features that we're not even using in Cisco ISE. So we use what is relevant for our own use case.
I recommend that individuals conducting research on the solution take a thorough look at 802.1X and gain a comprehensive understanding of how it can offer the desired level of security.
We utilize Cisco throughout our environment and chose ISE due to our familiarity with all of Cisco's products.
I do the designing and implementation and hand it over to the customer. Sometimes, I provide support to the customer. The solution is used for network access control. I have implemented almost all the features of the product.
TACACS is valuable. The product is useful for device administration.
We face many bugs. The vendor is trying to improve it by releasing new patches and hotfixes.
I have been using the solution for almost five years.
I rate the tool’s stability a six out of ten. It breaks down a lot.
I rate the tool’s scalability a seven out of ten. To scale the solution, we must decide which persona should be added. There are different personas for management, monitoring, and policy enforcement. It needs some calculations. I have a lot of clients. One of my clients has 20,000 to 50,000 users.
The initial setup is not easy. It should be designed properly. The solution has almost two or three personas. The design must be reviewed correctly. The implementation is not easy. It is a little bit complex compared to other NAC solutions. The time taken for deployment depends on the size of the implementation. It can take from one week to one year.
The solution is not that cheap.
We are partners. A lot of customers are using Cisco’s infrastructure. The product can be integrated easily. We have faced a lot of issues while integrating other tools. Overall, I rate the solution an eight out of ten.
Identity Services Engine for us has an incredible number of use cases, predominantly around identity and contact sharing within the enterprise or Endpoint onboarding for, authentication and authorization. Most recently, in the last few years, we've actually finally added device authentication and device management into that with the TACACS implementation. And now we have a comprehensive set of features to perform enterprise NAC, pure RADIUS authentication, and user authorization.
Cisco Identity Services Engine has provided two incredibly beneficial outcomes for our clients. First and foremost, they've been able to limit and minimize the number of different discrete platforms they need to use to deliver things such as network admission control, device authorization, and posturing, as well as do device and policy enforcement at the endpoint level. The second one that really is under sung is the ability to comprehensively manage guests in BYOD wireless access. The ability for the enterprise pretty much out of the box to deploy an end-to-end solution to manage guest onboarding, user self-service, as well as bring your own device has been a real boom to network access.
Using ISE to detect and remediate threats is really the hinge pin for pretty much everything in the Cisco security infrastructure. Without identity and without context, you really can't do any enforcement. It's fine to be able to detect a threat with an IPS, with a threat appliance, with anomaly detection, but being able to use things like RADIUS chains of authorization to then blacklist a host or remove a host from a production relay is an incredibly important outcome, not the least of which because that's all automated in ISE. And that's an incredible benefit to IT teams who perhaps don't have a NOC, don't have a SOC that can run out, and respond to a threat immediately. Having those SOAR automation capabilities inherent to the system is a really powerful feature set.
I think it's inevitable when a customer is deploying or using ISE that they're gonna find additional cycles that they can spend their time on. The rich automation and the quick startup out of the box, for instance, ISA has a really rich onboarding wizard. Pretty much out of the box, you can go through a series of steps, input your IP address, your domain names, etcetera. You don't have to do a lot of the upfront planning and design work that was required of previous systems that did network admission control, certainly more so than the old NAC. And so I believe that many customers will find they have extra cycles to go and use that IT talent to do more impactful projects than spending months and months and months deploying admission control.
Identity Services Engine has done a great advantage to our clients in the fact that Cisco has begun to move more capabilities into the platform over time. As they started out with the basic AAA capability, authentication, authorization, and accounting that was present in ACS and the older service architecture, they've now begun to move in, device administration in the form of the TACACS server and other capabilities within ISE. When they previously introduced the pxGrid capability, you now have the ability to bring other enterprise platforms such as your IPS, your threat systems, and your DNS security platforms directly into ISE for performing all those automation. And so it absolutely has consolidated the number of platforms that you need to deploy to achieve that secure outcome.
The effect of the consolidation of all of these functionalities within Identity Services Engine has had on IT is that now you have a single platform with which to maintain. I think sometimes we overlook the fact that security platforms themselves have a lifecycle associated with them. We have to patch these systems. We have to maintain currency on the devices. And over time, those devices like anything else become a little long in the tooth and require refreshing. The flexibility to deploy Identity Services Engine in multiple persona types on hardware or in a virtual machine is a huge advantage to customers who want to consolidate the number of vendors and hardware platforms that they have to support and manage.
Identity Services Engine has helped a lot of our clients as well as Logicalis simplify the way that we approach compliance governance and risk consulting within our own enterprise, being able to have a single source context for when devices were on the network when they were last authenticated, and, of course, that rich user context that we get. We can now share contextual information from Identity Services Engine within an Azure environment, within an AWS environment with our own active directory, and that's an enormous advantage when you're not only threat hunting, but when you're trying to pass those checks and balances that are required for cybersecurity insurance or your own internal compliance auditing.
For us and our clients, the most valuable features of Identity Services Engine are really around the rich contact sharing that ISE gives you. The ability to categorically list all the endpoints in the infrastructure, understand where they are, how they made it onto the wire, whether that was through wireless, through a wired engagement, And all of the self-service features that allow you to manage guest access to wired and wireless infrastructure are an incredible number of use cases that our clients are constantly deploying now.
I think in any technology infrastructure, you're going to have environments where improvements could occur. I think some areas where ISE could be better are perhaps in the number of integrations that they offer from a virtual standpoint, as well as having a better and more comprehensive pathway for the customer to go from a physical environment to a virtual one. Many of our clients today are hybrid. They have a physical footprint in a data center somewhere, as well as a public cloud instance for things. Today there really isn't an elegant pathway for a client that wants to go 100 percent cloud, and that's an improvement I think that could be along the way.
The stability of the Cisco Identity Services Engine has continued to improve over time as the product has matured. Anytime you're dealing with something like a database product that has millions or hundreds of thousands of endpoints and entries in it, inevitably you're going to have performance creep over time. Because of the scale of the Cisco purpose-built UCS appliances, the SNS appliances that predominantly run identity services engine, we've seen an enormous advantage by staying up to date on the most current Cisco SNS appliances. We've also seen an enormous advantage by leveraging ISE in a hybrid capacity. So the ability to deploy PSMs on a hybrid cloud environment, on a public cloud environment, as either additional capacity or as a failover point for that on-premise install base is a really nice advantage to have.
The beauty of Identity Service Engine is the fact that there's really no environment too small. If you have 500 to 1000, maybe up to 2000 endpoints, We're talking laptops, mobile devices, access point switches, etcetera. You're really not too small to deploy Identity Service Engine. The beauty of the multi-persona design of the Identity Service Engine is that you can leverage that capability to split off those PSN personas which is actually the persona within the Identity Service Engine that processes all of that high rate of radius authorization and authentication traffic. So the scalability of ISE is really well thought out. It was really well thought out from the get-go. You can also split off the admin personas and the monitoring and logging personas as well to give you that horizontal scale. I'm not sure today what the exact endpoint count that ISE scales to is, but it is certainly into the hundreds of thousands of endpoints.
Cisco support for Identity Services Engine has been world-class. The guts of ISE are still a RADIUS server. They're still AAA-based functionality. So many folks that have been deploying and supporting the Cisco Secure ACS Server as well as the TACACS server and all of the things that have come along with that, continue to use the same skill set to support and deploy ISE. Really, the differences nowadays in terms of support are bringing about more comprehensive offerings to support the systems that surround ISE. Many things plug into ISE and provide much richer context, and really that's where the complexity tends to creep in. Our support from Cisco both as an end user and a partner has been beyond reproach, and we really appreciate Cisco's continued investment in the TAC, and in all the areas they bring to bear to help you receive that business outcome you're after.
Cisco support is always going to be ranked a strong nine with me, mainly because we know there's always room to improve things. We don't want to give a full passing score, but without a doubt, I don't know how anyone could consume and deploy business outcomes with Cisco technologies without leveraging support. And so Cisco leads the way and continues to invest in that area.
Positive
The deployment experience with ISE in the early stages was without a doubt, very daunting. There is a huge number of things that you need to understand about the existing infrastructure, about the existing customer environment to properly deploy that solution. As time has gone on, however, the designers and the developers of that software have begun to create wizard, have begun to create additional upfront deployment tactics within the tool itself so that essentially a journeyman network engineer or security architect can deploy the minimum level of functionality right out of the box.
It's difficult to say whether the clients have seen an immediate ROI with the deployment of the Identity Services Engine. Oftentimes, you have to take on additional technologies in the ISE product family in order to receive that comprehensive benefit. So I think only time will tell what the true ROI is. I can tell you that the value exchange that occurs between a partner and a client when we're talking about everything within the Cisco security portfolio being fully integrated together and working comprehensively has been an enormous advantage to customers who today have a complex act of multi-vendor products. Being able to consolidate on a platform-based solution is an incredibly powerful story to tell, and it's also incredibly powerful from a cost-benefit standpoint as well.
In terms of the licensing and the pricing structure of the Cisco Identity Services Engine, there's been a huge advantage to our clients recently with the advent of the enterprise agreement. You now have an enterprise agreement choice, which now allows you to buy as few as two security products to unlock additional discounting and additional life cycle advantages when you consume that solution for security business outcomes. At Logicalis, we deliver a full life cycle approach to Identity Services Engine when embedded into a Cisco security enterprise agreement. We're able to deliver not only the onboarding and the design guidance that the customer needs to deliver that secure business outcome, but also provide the ancillary services to support all of the other infrastructure that often comes along with deploying a solution like ice.
Identity Services Engine compares favorably with many of the other competitor's products that are in that space. I won't mention them now, but I think we know that all of the same industry competitors have been delivering identity solutions and NAC solutions over the last decade or so. Cisco continues to rank in the upper and farther to the right in Gartner Magic Quadrant for those identity solutions, and I think they'll continue on that trajectory. Cisco has long been the number one network vendor in the world, and I think you'll continue to see that growth as the network continues to be important to business.
I rate Cisco Identity Services Engine a ten, on a scale of one to ten. It's a necessary solution to deploy in order to achieve many of the business outcomes such as some of the smart business architectures, certainly anything within the automated campus designs that are out there with DNA Center. It's just an incredibly powerful tool to manage both identity and endpoints within the infrastructure, and it really does become the hub of a hub and spoke comprehensive security architecture.
When Identity Services Engine became the de facto migration path from ACS Access Control Server, we were very early adopting and getting that product into our labs and in the hands of our customers for proofs of concept, proofs of value, and enterprise pilots.
