Register The Asa With The Ise; Create A Security Group On The Ise - Cisco ASA Series Configuration Manual

About Cisco TrustSec
Scalability
The following table shows the number of IP-SGT mapping entries that the ASA supports.
Table 6-1
ASA Model
5585-X with SSP-10
5585-X with SSP-20
5585-X with SSP-40
5585-X with SSP-60
The following table shows the number of SXP connections that the ASA supports.
Table 6-2
ASA Model
5585-X with SSP-10
5585-X with SSP-20
5585-X with SSP-40
5585-X with SSP-60

Register the ASA with the ISE

The ASA must be configured as a recognized Cisco TrustSec network device in the ISE before the ASA
can successfully import a PAC file. To register the ASA with the ISE, perform the following steps:
1.
2.
3.
4.
5.
6.

Create a Security Group on the ISE

When configuring the ASA to communicate with the ISE, you specify a AAA server. When configuring
the AAA server on the ASA, you must specify a server group. The security group must be configured to
use the RADIUS protocol. To create a security group on the ISE, perform the following steps:
1.
Cisco ASA Series Firewall CLI Configuration Guide
6-10
Capacity Numbers for IP-SGT Mapping Entries
SXP Connections
Log into the ISE.
Choose Administration > Network Devices > Network Devices.
Click Add.
Enter the IP address of the ASA.
When the ISE is being used for user authentication, enter a shared secret in the Authentication
Settings area.
When you configure the AAA sever on the ASA, provide the shared secret that you create here on
the ISE. The AAA server on the ASA uses this shared secret to communicate with the ISE.
Specify a device name, device ID, password, and a download interval for the ASA. See the ISE
documentation for how to perform these tasks.
Log into the ISE.
Number of IP-SGT Mapping Entries
18,750
25,000
50,000
100,000
Number of SXP TCP Connections
150
250
500
1000
Chapter 6 ASA and Cisco TrustSec