Skip to content

Cisco ISE: CLI (ERS API)

Cisco ISE has no policy-configuration command line; its supported programmatic interface is the ERS REST API (External RESTful Services). This page uses curl against ERS to script the endpoint-allowlist half of the fix: creating the endpoint identity group and registering the appliance MAC in it. The authorization profile, the policy-set rule, and the posture bypass are policy objects that ERS does not manage; apply those in the admin portal with the GUI (ISE admin portal) guide.

Before you start

Review the Cisco ISE overview for the full three-step fix (MAB allowlist → authorized VLAN → posture bypass). You will need:

  • The ISE Primary Administration Node address (<ISE_PAN>)
  • An internal ISE admin account in the External RESTful Services Admin group (<ERS_ADMIN> / <ERS_PASSWORD>)
  • The appliance MAC address (<RTA_MAC>) in aa:bb:cc:dd:ee:ff (colon-separated) format; see how to find it

1. Enable ERS

ERS is disabled by default. In the admin portal, navigate to Administration → System → Settings → API Settings and enable ERS (Read/Write).

ERS listens on HTTPS port 9060 and uses basic authentication. The account you call it with must be an internal ISE admin assigned to the External RESTful Services Admin group.

Note

Every request needs the Accept (and, for writes, Content-Type) header shown below. If your workstation does not trust the ISE admin certificate, add --cacert <path-to-ca-cert> to each curl command. On ISE 3.1 and later the API gateway can also serve ERS on port 443; these examples use the classic port 9060.

2. Create the endpoint identity group

Create a dedicated RTA-Appliances group so the authorization rule stays narrow and the entry is easy to remove after the engagement:

curl -X POST "https://<ISE_PAN>:9060/ers/config/endpointgroup" \
  -u '<ERS_ADMIN>:<ERS_PASSWORD>' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "EndPointGroup": {
      "name": "RTA-Appliances",
      "description": "Sophos RTA engagement appliances",
      "systemDefined": false
    }
  }'

A successful create returns HTTP 201 with the new group's URL in the Location response header. Retrieve the group's ID (needed in the next step):

curl "https://<ISE_PAN>:9060/ers/config/endpointgroup?filter=name.EQ.RTA-Appliances" \
  -u '<ERS_ADMIN>:<ERS_PASSWORD>' \
  -H 'Accept: application/json'

Note the id value in the response; it is <GROUP_ID> below.

3. Register the appliance MAC as an endpoint

Create the endpoint record with a static assignment to the group, so ISE profiling cannot move it later:

curl -X POST "https://<ISE_PAN>:9060/ers/config/endpoint" \
  -u '<ERS_ADMIN>:<ERS_PASSWORD>' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{
    "ERSEndPoint": {
      "name": "RTA-Appliance",
      "description": "Sophos RTA engagement appliance",
      "mac": "<RTA_MAC>",
      "groupId": "<GROUP_ID>",
      "staticGroupAssignment": true
    }
  }'

Again, HTTP 201 confirms the endpoint was created. The appliance MAC is now allowlisted in the RTA-Appliances identity group.

4. Finish in the admin portal

The remaining steps are policy objects that ERS does not cover, so they stay in the admin portal:

Note

ISE 3.1 and later also expose an Open API that covers some policy objects, but this one-time rule is quicker and safer to add in the portal, so this guide does not script it.

5. Apply and verify

Bounce the appliance's switch port (or trigger a CoA re-authentication) and confirm the session in Operations → RADIUS → Live Logs, exactly as in the GUI guide's Apply and verify step.

Remove the entry after the engagement

Remove the allowlist entry after the engagement

MAB authorizes by MAC address, which can be spoofed. Remove the endpoint record (and optionally the identity group) when the engagement ends to prevent unauthorized access to the authorized VLAN.

Find the endpoint's ID by MAC, then delete it:

curl "https://<ISE_PAN>:9060/ers/config/endpoint?filter=mac.EQ.<RTA_MAC>" \
  -u '<ERS_ADMIN>:<ERS_PASSWORD>' \
  -H 'Accept: application/json'

curl -X DELETE "https://<ISE_PAN>:9060/ers/config/endpoint/<ENDPOINT_ID>" \
  -u '<ERS_ADMIN>:<ERS_PASSWORD>' \
  -H 'Accept: application/json'

To remove the (now empty) identity group as well:

curl -X DELETE "https://<ISE_PAN>:9060/ers/config/endpointgroup/<GROUP_ID>" \
  -u '<ERS_ADMIN>:<ERS_PASSWORD>' \
  -H 'Accept: application/json'