Cisco ISE, Release 3.2, can be installed on the following platforms:

After installation, you can configure Cisco ISE with specific component personas such as Administration, Monitoring, or pxGrid on the platforms that are listed in the above table. In addition to these personas, Cisco ISE contains other types of personas within Policy Service, such as Profiling Service, Session Services, Threat-Centric NAC Service, SXP Service for TrustSec, TACACS+ Device Admin Service, and Passive Identity Service.

Caution

*Cisco ISE 3.1 Patch 6 and above, and Cisco ISE 3.2 Patch 2 and above versions support Cisco SNS 3700 series appliances. Cisco ISE 3.1 and later releases do not support Cisco Secured Network Server (SNS) 3515 appliance. Cisco SNS 3400 Series appliances are not supported in Cisco ISE, Release 2.4, and later. Memory allocation of less than 16 GB is not supported for VM appliance configurations. In the event of a Cisco ISE behavior issue, all the users will be required to change the allocated memory to at least 16 GB before opening a case with the Cisco Technical Assistance Center. Legacy Access Control Server (ACS) and Network Access Control (NAC) appliances (including the Cisco ISE 3300 Series) are not supported in Cisco ISE, Release 2.0, and later.

Cisco ISE supports the following virtual environment platforms:

• For Cisco ISE Release 3.0 and later releases, we recommend that you update to VMware ESXi 7.0.3 or later releases.

  • OVA templates: VMware version 14 or later on ESXi 6.7 and ESXi 7.0 .

  • ISO file supports ESXi 6.7 and later releases ESXi 6.7, ESXi 7.0, and ESXi 8.0.

  You can deploy Cisco ISE on VMware cloud solutions on the following public cloud platforms:

  • VMware cloud in Amazon Web Services (AWS): Host Cisco ISE on a software-defined data center provided by VMware Cloud on AWS.

  • Azure VMware Solution: Azure VMware Solution runs VMware workloads natively on Microsoft Azure. You can host Cisco ISE as a VMware virtual machine.

  • Google Cloud VMware Engine: Google Cloud VMware Engine runs software defined data center by VMware on the Google Cloud. You can host Cisco ISE as a VMware virtual machine on the software-defined data center provided by the VMware Engine.

  Note

  From Cisco ISE 3.1, you can use the VMware migration feature to migrate virtual machine (VM) instances (running any persona) between hosts. Cisco ISE supports both hot and cold migration. Hot migration is also called live migration or vMotion. Cisco ISE need not be shut down or powered off during the hot migration. You can migrate the Cisco ISE VM without any interruption in its availability.

• Microsoft Hyper-V on Microsoft Windows Server 2012 R2 and later

• KVM on QEMU 2.12.0-99 and later

  Note	Cisco ISE cannot be installed on OpenStack.

• Nutanix AHV 20220304.392

You can deploy Cisco ISE natively on the following public cloud platforms:

• Amazon Web Services (AWS)

• Microsoft Azure Cloud

• Oracle Cloud Infrastructure (OCI)

For information about the virtual machine requirements, see the Cisco Identity Services Engine Installation Guide for your version of Cisco ISE.

Cisco ISE uses embedded Federal Information Processing Standard (FIPS) 140-2-validated cryptographic module, Cisco FIPS Object Module Version 7.2a (Certificate #4036). For details about the FIPS compliance claims, see Global Government Certifications.

Cisco ISE 3.2 is supported on the following browsers:

• Mozilla Firefox versions 102, 103, 104, 105, 106, 107, 108, 110, 113, 114, 119, 123,125, 127, and later

• Google Chrome versions 103, 104, 105, 106, 107, 108, 109, 110, 112, 114, 116, 117, 119, 122, 124, 126, and later

• Microsoft Edge versions 103, 104, 106, 107, 108, 109, 112, 115, and 117, 119, 122, 125, 126, and later

Note	Currently, you cannot access the Cisco ISE GUI on mobile devices.

Supported MDM servers include products from the following vendors:

• Absolute

• Blackberry - BES

• Blackberry - Good Secure EMM

• Cisco Meraki Systems Manager

• Citrix XenMobile 10.x (On-prem)

• Globo

• IBM MaaS360

• Ivanti (previously MobileIron UEM), core and cloud UEM services

  For the use case of handling random and changing MAC Addresses in Cisco ISE 3.1, you must integrate MobileIron Core 11.3.0.0 Build 24 and later releases to receive GUID values.

  Note	Some versions of MobileIron do not work with Cisco ISE. MobileIron is aware of this problem, and have a fix. Contact MobileIron for more information.

• JAMF Casper Suite

• Microsoft Endpoint Configuration Manager

• Microsoft Endpoint Manager Intune

• Mosyle

• SAP Afaria

• Sophos

• SOTI MobiControl

• Symantec

• Tangoe

• VMware Workspace ONE (earlier known as AirWatch)

• 42Gears

For the configurations that you must perform in your endpoint management servers to integrate the servers with Cisco ISE, see Integrate UEM and MDM Servers With Cisco ISE.

For information about the antivirus and antimalware products supported by the Cisco ISE posture agent, see Cisco AnyConnect ISE Posture Support Charts.

In a clean or fresh install of Cisco ISE, SHA1 ciphers are disabled by default. However, if you upgrade from an existing version of Cisco ISE, the SHA1 ciphers retain the options from the earlier version. You can view and change the SHA1 ciphers settings using the Allow SHA1 Ciphers field (Administration > System > Settings > Security Settings).

Note	This does not apply to the Admin portal. When running in Federal Information Processing Standard Mode (FIPS), an upgrade does not remove SHA1 ciphers from the Admin portal.

Cisco ISE supports TLS versions 1.0, 1.1, and 1.2.

Cisco ISE supports RSA and ECDSA server certificates. The following elliptic curves are supported:

• secp256r1

• secp384r1

• secp521r1

Note	Cisco ISE does not support intermediate certificates having SHA256withECDSA signature algorithm for any of the elliptical curves due to the limitations in the current implementation of OpenJDK 1.8.

The following table lists the supported Cipher Suites: