Cisco Identity Services Engine (ISE) Reviews

In my humble opinion, Cisco ISE is a highly recommended product.
There are multiple application scenarios but I consider that if some of the following premises are met, I would not hesitate to go for it:

- Network authentication based on LDAP or Certificates is required

- Authentication, authorization and accounting are required for administrative access.

- Granular permission delegation is required.

- It seeks to automate actions at the network access level based on security risks in real time.

We deploy Cisco Identity Service Engine (ISE) to provide the following types of services:

• Network device administration - provide AAA services (Authentication, Authorization & Accounting) for any IT users who need to access Cisco routers, switches and firewalls
• 802.1x - Network Access Control for any users accessing the network as a wired, wireless or VPN client
• Profiling services - used to profile new devices on the network and is particularly useful for devices that do not support 802.1x (e.g. some IP phones)
• A whole host of other functionality is available with particular use cases

I do think that Cisco ISE may not be appropriate for really small networks, due to the purchase costs and complication of management.

Cisco support is second to none, both in terms of how you access support but also the knowledge of the individual support teams. If you focus on one technology and provide "manufacturer support" then you can rest assured that you are accessing Cisco's top individuals.

I feel like this is a USP for Cisco support.

If you really want to do advanced authentication with profiling, posturing, etc. ISE really is a great solution. However, if you are looking for a very basic authentication solution with no further visiblity or authentication flows, cheaper solutions are available from many different vendors. Although I have only experienced Microsoft Network Policy Server as another solution, I must say that ISE is easier to troubleshoot endpoint problems and have more visibility all around.

For us the solution is very easily useable on its own. Perhaps that has to do because we started using ISE in the 1.2 days and have seen it grow during the years. Policy creation, etc. is all very visible and thus easy to use. Deployment of multiple nodes is also incredibly easy and flexible. You can easily add or remove nodes as you wish.

We usually see very little issues, but when we do our support partner usually makes contact with TAC in order to get us going again. We usually see frequent patches in the works for ISE.

Cisco ISE is well suited as an 802.1x authentication server. Other features come on top of it to accurately make the network decide who connects to what in a very secure way. Yes, there are other vendors with the same capability but I suspect that they do not have the same feature set as ISE.

It requires an expert in the ISE to be able to operate it. It requires lots of reading to be able to accomplish what you need, and yes, such solutions are expected to be complex.

Skilled TAC when it comes to such product, nothing more to say.

If you have just a few device types, fairly flat network (a limited number of VLANs and remote sites, for instance), or don't need exceptions to rules or non-802.1x devices, it might be good for you. Or if you just need guest on-boarding, then that might be a good system. But, then again, if that's your environment, then maybe you just go with the Meraki line.

Again, this should be a huge zero! So many calls back to support, hotfixes, and escalations. Once you get past the basics, you change one thing and two things break. Hours on the phone with support, time on hold with "I need to check with xyz. Hang on." Our network infrastructure is mostly Cisco, so it's not like we can blame it on a lot of non-Cisco components. And when unrecognized devices came on-board, there was a whole new set of issues that had to be escalated.

We have hundreds of devices, and it's great that we can manage them from one system. We have different vendors and Cisco ISE handles them all. We are a corporate environment where every team uses different systems and has different needs. Cisco ISE and very robust and can handle pretty much all situations and devices. We use this where TACACS is dipping into our AD system and it works great. Cisco ISE would be less Ideal if you are not using a TACACS or Radius and just have users. You could add all the users into ISE, but that seems like a lot of work.

You can always get someone to talk to right away, and I love that they have chat. For the most part, even their first contact reps are very knowledgable. With this being a Cisco product, there are a ton of online documentation and forums where you can get expert help.