Assigning an IP Address to an ANC Policy

The pxGrid client assigns an endpoint IP address to an ISE ANC policy. For more information on the ANC Configuration topic, please see: ANC Configuration

Code Step-Through

The public class ANCApplyIP defines the string name for the ISE ANC policy and the IP Address for the desired endpoint to be quarantines

The private static void apply method calls SampleConfigObject string name and ip address. The Sample config object contains the pxGrid connection parameters such as the ISE pxGrid name hostname, identity filename keystore (.jks) filename and the truststore keystore (.jks)filename and we receive the new pxGrid control object. The pxGrid control configuration contains the pxGrid client account, service lookup, and access secret obtained from the ISE pxGrid node

Under //pxGrid ServiceLookup for session service, a service lookup is performed for the ISE node publishing the com.cisco.ise.config.anc service. If there were more the (1) ISE node in the pxGrid, randomization would be performed to find the availble node. This of this is as load balancing to evenly distribute the load.

Under //User first service, we get WebSockets URL from "restBaseUrl" + "/applyEndpointByIpAddress"

Under //pxGrid AccessSecret for the node, we obtain the secret from the ISE pxGrid node and we apply ApplyEndpointPolicyByIpRequest for the desired IP Address and ANC policy name

SampleHelper.postObjectAndPrint obtains the ISE pxGrid node, access secret, WebSocket URL, and trust information from the Client Manager.

Main parses the SampleObject Parameters

Under //Account Activate we obtain the pxGridcontrol and wait 60 seconds for the pxGrid client account to be activated, the pxGrid controller version is received, the desired IP address is applied to the desired ANC policy.

JAVA Sample Code

package com.cisco.pxgrid.samples.ise;

import java.io.IOException;

import org.apache.commons.cli.ParseException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.cisco.pxgrid.samples.ise.model.AccountState;
import com.cisco.pxgrid.samples.ise.model.Service;

/**
 * Demonstrates how to apply an endpoint IP address to an ANC policy
 */
public class ANCApplyIP {
    private static Logger logger = LoggerFactory.getLogger(ANCApplyIP.class);
    private static class ApplyEndpointPolicyByIpRequest {
        private String policyName;
        private String ipAddress;
        public void setPolicyName(String policyName) {
            this.policyName = policyName;
        }
        public void setIpAddress(String ipAddress) {
            this.ipAddress = ipAddress;
        }
        
    }	
    
    private static void apply(SampleConfiguration config, String policyName, String ip) throws IOException {
        PxgridControl pxgrid = new PxgridControl(config);
        
        // pxGrid ServiceLookup for session service
        Service[] services = pxgrid.serviceLookup("com.cisco.ise.config.anc");
        if (services == null || services.length == 0) {
            System.out.println("Service unavailabe");
            return;
        }
        
        // Use first service
        Service service = services[0];
        String url = service.getProperties().get("restBaseUrl") + "/applyEndpointByIpAddress";
        logger.info("url={}", url);
        
        // pxGrid AccessSecret for the node
        String secret = pxgrid.getAccessSecret(service.getNodeName());
        ApplyEndpointPolicyByIpRequest request = new ApplyEndpointPolicyByIpRequest();
        request.setPolicyName(policyName);
        request.setIpAddress(ip);
        SampleHelper.postObjectAndPrint(url, config.getNodeName(), secret, config.getSSLContext().getSocketFactory(), request);
    }

    public static void main(String [] args) throws Exception {
        // Parse arguments
        SampleConfiguration config = new SampleConfiguration();
        try {
            config.parse(args);
        } catch (ParseException e) {
            config.printHelp("ANCApplyIP");
            System.exit(1);
        }

        
        // AccountActivate
        PxgridControl pxgrid = new PxgridControl(config);
        
        while (pxgrid.accountActivate() != AccountState.ENABLED)
            Thread.sleep(60000);
        logger.info("pxGrid controller version={}", pxgrid.getControllerVersion());
        
        String policyName = SampleHelper.prompt("Policy name: ");
        String ip = SampleHelper.prompt("IP address: ");
        apply(config, policyName, ip);
        }
    }

Output Results

------ config ------
  hostname = ise24fc3.lab10.com
  nodename = mac05
  password = (not specified)
  description = (not specified)
  keystorefilename = /Applications/master_rest_samples/sw1.jks
  keystorepassword = Cisco123
  truststorefilename = /Applications/master_rest_samples/sw1root.jks
  truststorepassword = Cisco123
--------------------
20:36:25.943 [main] INFO com.cisco.pxgrid.samples.ise.PxgridControl - AccountActivate request={}
20:36:26.132 [main] INFO com.cisco.pxgrid.samples.ise.PxgridControl - AccountActivate response={"accountState":"ENABLED","version":"2.0.0.13"}
20:36:26.132 [main] INFO com.cisco.pxgrid.samples.ise.ANCApplyIP - pxGrid controller version=2.0.0.13
Policy name: 
ANC_QUARANTINE_EXAMPLE
IP address: 
192.168.1.19
20:36:55.221 [main] INFO com.cisco.pxgrid.samples.ise.PxgridControl - ServiceLookup request={"name":"com.cisco.ise.config.anc"}
20:36:55.246 [main] INFO com.cisco.pxgrid.samples.ise.PxgridControl - ServiceLookup response={"services":[{"name":"com.cisco.ise.config.anc","nodeName":"ise-admin-ise24fc3","properties":{"wsPubsubService":"com.cisco.ise.pubsub","restBaseUrl":"https://ise24fc3.lab10.com:8910/pxgrid/ise/config/anc","statusTopic":"/topic/com.cisco.ise.config.anc.status"}}]}
20:36:55.246 [main] INFO com.cisco.pxgrid.samples.ise.ANCApplyIP - url=https://ise24fc3.lab10.com:8910/pxgrid/ise/config/anc/applyEndpointByIpAddress
20:36:55.250 [main] INFO com.cisco.pxgrid.samples.ise.PxgridControl - AccessSecret request={"peerNodeName":"ise-admin-ise24fc3"}
20:36:55.265 [main] INFO com.cisco.pxgrid.samples.ise.PxgridControl - AccessSecret response={"secret":"RhntxITOSQNNCh9y"}
20:36:55.320 [main] INFO com.cisco.pxgrid.samples.ise.SampleHelper - postData={"policyName":"ANC_QUARANTINE_EXAMPLE","ipAddress":"192.168.1.19"}
20:36:55.891 [main] INFO com.cisco.pxgrid.samples.ise.SampleHelper - Response status=200
Content: {"operationId":"ise24fc3.lab10.com:0","macAddress":"00:0E:C6:8F:B4:9B","status":"RUNNING"}

What happens in ISE

Select Operations->Adaptive Network Control->Endpoint. You should see the MAC address of the endpoint applied to the ANC policy.

Select Operations->RADIUS->LiveLogs. You should see the endpoint as quarantined as defined by the ISE ANC policy.

Here is the defined ISE Authorization ANC Policy