7 Download Services v3.2.4 serial key or number

The Monitoring and Troubleshooting (MnT) service is a comprehensive identity solution for all Cisco ISE run-time services. The Operations menu contains the following components, and can be viewed only from the primary Policy Administration Node (PAN). Note that the Operations menu does not appear in the primary Monitoring node.

• Monitoring: Provides real-time presentation of meaningful data representing the state of access activities on a network. This insight allows you to easily interpret and affect operational conditions.

• Troubleshooting: Provides contextual guidance for resolving access issues on networks. You can then address user concerns and provide resolution in a timely manner.

• Reporting: Provides a catalog of standard reports that you can use to analyze trends and monitor system performance and network activities. You can customize reports in various ways and save them for future use. You can search records using wild cards and multiple values in all the reports for the Identity, Endpoint ID, and ISE Node (except the Health Summary report) fields.

Network Privilege Framework Event Flow Process

The Network Privilege Framework (NPF) authentication and authorization event flow uses the process described in the following table:

User Roles and Permissions for Monitoring and Troubleshooting Capabilities

Monitoring and troubleshooting capabilities are associated with default user roles. The tasks you are allowed to perform are directly related to your assigned user role.

See section "Cisco ISE Administrator Groups" in Chapter "Cisco ISE Admin Guide: Overview" in Cisco ISE Administrator Guide for information on the permissions and restrictions set for each user role.

Note	Accessing Cisco ISE using the root shell without Cisco TAC supervision is not supported, and Cisco is not responsible for any service disruption that might be caused as a result.

Data Stored in the Monitoring Database

The Cisco ISE monitoring service collects and stores data in a specialized monitoring database. The rate and amount of data utilized to monitor network functions may require a node dedicated solely to monitoring. If your Cisco ISE network collects logging data at a high rate from policy service nodes or network devices, we recommend a Cisco ISE node dedicated to monitoring.

To manage the information stored in the monitoring database, perform full and incremental backups of the database. This includes purging unwanted data and then restoring the database.

Cisco ISE Telemetry

Telemetry monitors your system and devices in your network to provide feedback to Cisco on how you use the product. Cisco uses this information to improve the product.

Telemetry is enabled by default. To disable this feature:

1. Choose Administration > System > Settings > Network Success Diagnostics > Telemetry.

2. Uncheck the Enable Telemetry check box to disable telemetry.

   With Cisco ISE 2.4 Patch 12, telemetry is disabled immediately. Before applying the patch, It may take up to 24 hours after the feature is disabled for Cisco ISE to stop sharing telemetry data.

Telemetry requires Smart Licensing. If you are not already using smart licensing, see Smart Licensing in the Licensing book for your version of Cisco ISE.

• Cisco Account: Enter your Cisco account so you can get emails from Telemetry. We may also use this ID to contact you if Telemetry finds any serious issues that may affect you.

• Transport Gateway: You can use a proxy between your Cisco ISE and the Cisco external telemetry servers for extra security. To do this, check this check box and enter the FQDN of your proxy server. Telemetry does not require a proxy.

  Cisco provides software for Transport Gateway. You can download from cisco.com. This software runs on a Linux server. See the Smart Call Home Deployment Guide for information on how to deploy the Transport Gateway software on an RHEL server. If you are using this Cisco software, the URL value is <FQDN of proxyserver>/Transportgateway/services/DeviceRequestHandler. You can use this gateway to connect to the Smart Licensing server, too. From Version 3.5 of the Transport Gateway, you cannot change the port, but you can enter IP address instead of the FQDN.

Information that Telemetry Gathers

Nodes:

For each PAN node:

• Current number of postured endpoints

• Current number of PxGrid clients

• Current number of endpoints managed by MDM

• Current number of Guest users

• Start and end date of this telemetry record

For each PSN node:

• Number of profiler probes

• Node service type

• Passive ID used

For All nodes

• Number of CPU cores

• VM available disk space

• System Name

• Serial number

• VID and PID

• Uptime

• Last CLI login

MnT node count

pxGrid node count

Licenses

• Have any licenses expired?

• Number of Apex licenses available, maximum ever used

• Number of Base licenses available, maximum ever used

• Number of Plus licenses available, maximum ever used

• Number of small, medium, and large VM licenses

• Is an evaluation license in use?

• Name of the smart account

• Number of TACACS devices

• Expiration date, remaining days, license term

• Service types, primary and secondary UDI

Posture

• Number of inactive policies

• Last Posture Feed update

• Number of active policies

Guest Users

• Maximum number of authenticated guests for the day

• Maximum number of active guests for the day

• Maximum number of BYOD users for the day

Network Access

For each NAD:

• Authorization: Activated ACLs, VLANS, Policy size

• NDG map and NAD hierarchy

• Authentication:

  • Number of RADIUS, RSA ID, LDAP, ODBC, and Active Directory ID stores

  • Number of local (non-admin) users

  • NDG map and NAD map

  • Number of policy lines

For authorizations, active VLANs, policy count, number of activated ACLs:

• Status, VID, PT

• Average load, memory usage

• Number of PAP, MnT, pxGrid, and PIC nodes

• Name, profile name, profile ID

NAD Profile

For each NAD profile:

• Name and ID

• Cisco device

• TACACS support

• RADIUS support

• Trustsec support

• Default profile

Profiler

• Date of last feed update

• Are automatic updates enabled?

• Endpoints profiled, endpoint type, unknown endpoints, percentage unknown, and total endpoint count

• Number of custom profiles

• Serial number, scope, endpoint types, custom profiles

MDM

• List of MDM nodes

• For a date range, current MDM endpoint count, current guest user count, current postured users count

• pxGrid client count

• Node count

SNMP Traps to Monitor Cisco ISE

Generic SNMP Traps in Cisco ISE

SNMP traps help you to monitor the status of Cisco ISE. If you want to monitor Cisco ISE without accessing the Cisco ISE server, you can configure a MIB browser as an SNMP host in Cisco ISE. You can then monitor the status of Cisco ISE from the MIB browser.

See the Cisco Identity Services Engine CLI Reference Guide for information on the snmp-server host and snmp-server trap commands.

Cisco ISE supports SNMPv1, SNMPv2c, and SNMPv3.

Cisco ISE sends the following generic system traps if you configure the SNMP host from the CLI:

• Cold start: When the device reboots.

• Linkup: When Ethernet interface is up.

• Linkdown: When Ethernet interface is down.

• Authentication failure: When the community strings do not match.

The following table lists the generic SNMP traps that are generated by default in Cisco ISE.

Process-Monitoring SNMP Traps in Cisco ISE

Cisco ISE allows you to send hrSWRunName traps for Cisco ISE process statuses to the SNMP manager if you configure an SNMP host from the Cisco ISE CLI. Cisco ISE uses a cron job to trigger these traps. The cron job retrieves the Cisco ISE process status from Monit. After you configure the SNMP-Server Host command from the CLI, a cron job runs every five minutes and monitors Cisco ISE.

Note	When an ISE process is manually stopped by an admin, Monit for the process also stops and no traps are sent to the SNMP manager. A process-stop SNMP trap is sent to the SNMP manager only when a process accidentally shuts down and is not automatically revived.

The following is an exhaustive list of process-monitoring SNMP traps in Cisco ISE.

Cisco ISE sends traps for the following statuses to the configured SNMP server:

• Process Start (monitored state)

• Process Stop (not monitored state)

• Execution Failed: When the process state changes from Monitored to Execution Failed, a trap is sent.

• Does Not Exist: When the process state changes from Monitored to Does Not Exist, a trap is sent.

A unique object ID (OID) is generated for every object in the SNMP server and a value is assigned to the OID. You can find the object with its OID value in the SNMP server. The OID value for a running trap is running, and the OID value for the not monitored, does not exist, and execution failed traps is stopped.

Cisco ISE sends traps using the OID of hrSWRunName that belongs to the HOST-RESOURCES MIB, and sets the OID value as < PROCESS NAME > - < PROCESS STATUS >, for example, runtime - running.

To stop Cisco ISE from sending SNMP traps to the SNMP server, remove the SNMP configuration from the Cisco ISE CLI. This operation stops sending SNMP traps and polling from the SNMP manager.

Disk Utilization SNMP Traps in Cisco ISE

When a Cisco ISE partition reaches its threshold disk utilization limit and the configured amount of free space is reached, the disk utilization trap is sent.

Note	ISE does not have any MIB for process status or disk utilization. Cisco ISE uses OID HOST-RESOURCES-MIB::hrSWRunName for sending SNMP trap. You cannot use SNMP walk or SNMP get command to query the process status or disk utilization.

The following is an exhaustive list of disk utilization SNMP traps that can be configured in Cisco ISE:

Cisco ISE Alarms