ISE is a consolidated policy-based access control system that combines authentication, authorization, accounting (AAA) and guest management in one appliance. ISE v3.3 software runs on the Cisco Application Deployment Engine (ADE) Release 3.3 operating system (ADE-OS). ADE-OS is a Cisco-proprietary Red Hat Enterprise Linux based Operating system [RHEL v8.4 w/Linux kernel 4.18]. The TOE provides IPsec session capabilities to secure the channel between itself and the NAS.
\r\nNetwork access has evolved beyond just simple username and password verifications. Additional attributes related to users and their devices are used as decision criteria in determining authorized network access. Additionally, network service provisioning can be based on data such as the type of device accessing the network, including whether it is a corporate or personal device. Cisco ISE is a scalable solution that helps network administrators meet complex network access control demands by managing the many different operations that can place heavy loads on applications and servers, including:
\r\nISE delivers secure access control across wired, wireless, and VPN connections. ISE can reach deep into the network to deliver visibility into who and what are accessing resources. Through the device profiler feed service, ISE delivers automatic updates of Cisco’s validated device profiles for various IP-enabled devices from multiple vendors which simplifies the task of keeping an up-to-date library of the newest IP enabled devices.
\r\nThe Cisco Secure Network Server (SNS) is based on the Cisco UCS® C220 Rack Server and is configured specifically to support the Cisco Identity Services Engine (ISE) security application. The Secure Network Server supports these applications in three versions. The Cisco Secure Network Server 3715 is designed for small deployments. The Secure Network Servers 3755 and 3795 have several redundant components such as hard disks and power supplies, making it suitable for larger deployments that require highly reliable system configurations.
\r\nApart from the SNS models described above, ISE is also available as a Vitual Machine running on ESXi 7.0 on UCSC-C220-M6S. Cisco ISE supports the following virtual environment platforms, but only the ESXi 7.0 environment is a part of the evaluated configuration:
\r\nThe evaluated configuration of the TOE includes only one instance of ISE in a stand-alone deployment or one ISE instance in a network (see table below). The evaluated configuration of the TOE includes network devices utilizing the ISE authentication, authorization and accounting (AAA) features, remote administrator, local administrative console and a remote authentication store. Both the remote administrator and local administrator console capabilities must be supported.
Hardware Models | Cisco Identity Services Engine Appliance 3715 (SNS-3715) | Cisco Identity Services Engine Appliance 3755 (SNS-3755) | Cisco Identity Services Engine Appliance 3795 (SNS-3795) | Cisco Identity Services Engine – VM running on ESXi 7.0/UCSC-C220-M6S (ISE-VM) |
Processors | Intel Xeon Silver 4310 (Ice Lake) | Intel Xeon Silver 4316 (Ice Lake) | Intel Xeon Silver 4316 (Ice Lake) | Intel Xeon Silver 4310 (Ice Lake)[1] |
Memory | 32GB | 96 GB | 256 GB | 96 GB |
Hard disk | 1x600 Gb disk | 4x600Gb disk | 8x600Gb disk | 4x600Gb disk |
RAID | No | Yes (RAID 1+0) | Yes (RAID 1+0) | Yes (RAID 1+0) |
Network interface | 2 x 10GBase-T 4 x 10GE SFP (Intel X710) | 2 x 10GBase-T 4 x 10GE SFP (Intel X710) | 2 x 10GBase-T 4 x 10GE SFP (Intel X710) | Dual 10GBASE-T Ethernet ports (Intel x550) |
Hypervisor | None | None | None | ESXi 7.0 |
[1] While tested on the Intel Xeon Silver 4310 (Ice Lake), any Intel Xeon processor with the Ice Lake microarchitecture may be used as part of the evaluated configuration with VMware ESXi 7.0
The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Cisco Cisco Identity Services Engine (ISE) v3.3 Common Criteria Operational User Guidance and Preparative Procedures, version 1.0, April 21, 2025, ISE Configuration for EAP-TLS Server (Supplement to the Common Criteria Operational User Guidance And Preparative Procedures for ISEv3.3), version 1.0, April 21, 2025, Configuring Cisco Identity Services Engine Client Certificate Authentication for Administration Application, and Asset Visibility documents, satisfies all of the security functional requirements stated in the Cisco Identity Services Engine (ISE) V3.3 Security Target, version 1.0, April 21, 2025. The project underwent CCEVS Validator review. The evaluation was completed in April 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11517-2025) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Cisco Identity Services Engine (ISE) V3.3 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
The TOE’s Audit security function supports audit record generation and review. The TOE provides date and time information that is used in audit timestamps. The events generated by the TOE include indication of the logging starting and stopping, cryptographic operations, attempts to log onto the TOE, all commands/ web-based actions executed by the Security Administrator, and other system events.
\r\nThe TOE can store the generated audit data on itself, and it can be configured to send syslog events to other devices, including other iterations of ISE, using a TLS protected collection method. Logs are classified into various predefined categories. The TOE also provides the capability for the administrator to customize the logging output by editing the categories with respect to their targets, severity level, etc. The logging categories help describe the content of the messages that they contain. Access to the logs is restricted only to the Security Administrator, who has no access to edit them, only to copy or delete (clear) them. Audit records are protected from unauthorized modifications and deletions.
\r\nThe logs can be viewed by using on the ISE administration interface. The log record includes the category name, the message class, the message code (type of event), the message text (including a date/time stamp, subject (user) associated with the event, outcome of the event, etc.) and the severity level associated with the message. The previous audit records are overwritten when the allocated space for these records reaches the threshold.
\r\nThe TOE provides cryptography support for secure communication and protection of information. The cryptographic services provided by the TOE include: symmetric encryption and decryption using AES; asymmetric key generation; cryptographic key establishment using RSA-based and ECDSA key establishment schemes and DH key establishment; digital signature using RSA and ECDSA; cryptographic hashing using SHA1 (and other sizes); random bit generation using DRBG and keyed-hash message authentication using HMAC-SHA (multiple key sizes). ISE uses the CiscoSSL FIPS Object Module (FOM) Cryptographic Implementation as its cryptographic module. The TOE implements the secure protocols – SSH, TLS/HTTPS on the server side and TLS on the client side and IPsec session capabilities to secure the channel between the TOE and NAS.
\r\nThe TOE can validate the NAS and prevent it from being spoofed. It receives the transmitted Access-Request and identifies from where it is sent. The TOE is able to validate the authenticity of the NAS by verifying the Message Authenticator that is computed, in part, using a shared secret known to both the NAS and the TOE as defined in RFC 3579. It then returns a valid response to the NAS upon receipt of an Access-Request. The response contains the necessary information to the recipient of that message that identifies the TOE as the valid recipient of the original Access-Request and the Access-Request that elicited the response from the TOE.
\r\nAll users wanting to use TOE services are identified and authenticated prior to being allowed access to any of the services other than the display of the warning banner. Once a user attempts to access the management functionality of the TOE, the TOE prompts the user for a username and password for remote password-based authentication. The identification and authentication credentials are confirmed against a local user database or an optional remote authentication store (part of the IT Environment). Other authentication options include public key authentication. For remote X.509 certificate-based authentication to the administration application, a remote authentication store is required to perform the association of the credentials to an ISE Role Based Access Control role. For the SSH public key authentication method, the public keys configured by the EXEC CLI command \"crypto key import\" command will be used for signature verification. The user information is from the local user database. In all cases, only after the Administrator presents the correct identification and authentication credentials will access to the TOE functionality be granted. The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS/HTTPS connections. The revocation status of the certificates can be validated by the TOE using OCSP.
\r\nThe TOE provides the capability to set password minimum length rules. This is to ensure the use of strong passwords to protect against brute force attacks. The TOE also accepts passwords composed of a variety of characters to support complex password composition. During authentication, no indication is given of the characters composing the password.
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure session, a terminal server or a local console connection. The TOE provides the ability to perform the following actions:
\r\nAll management functions are restricted to the Security Administrator of the TOE, which covers all administrator roles. The Security Administrators of the TOE are individuals who manage specific types of administrative tasks. The Security Administrators are dependent upon the admin role assigned to them, which limits the network access or tasks they can perform (a role-based access approach).
\r\nThe primary management interface is the HTTPS Cisco ISE user interface. The Cisco ISE user interface provides an integrated network administration to manage various identity services. These services include authentication, authorization, posture, guest, profiler, as well as monitoring, troubleshooting, and reporting. All of these services can be managed from a single console window called the Cisco ISE dashboard. The navigation tabs and menus at the top of the window provide point-and-click access to all other administration features. A Command Line Interface (CLI) is also supplied for additional administration functionality like system-level configuration in EXEC mode and other configuration tasks in configuration mode and to generate operational logs for troubleshooting. This interface can be used remotely over SSHv2.
\r\nThe TOE can terminate inactive sessions after a Security Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session. The TOE provides protection of TSF data (authentication data and cryptographic keys). In addition, the TOE internally maintains the date and time. This date and time is used as the time stamp that is applied to TOE generated audit records. This time can be set manually and via NTP. The TOE is also capable of ensuring software updates are from a reliable source. Finally, the TOE performs testing to verify correct operation.
\r\nIn order for updates to be installed on the TOE, an administrator must use the digital signature mechanism to confirm the integrity of the product.
\r\nThe TOE can terminate inactive sessions after a Security Administrator configurable time-period. The TOE also allows users to terminate their own interactive session. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\nThe TOE can also display a Security Administrator specified banner on the CLI and the web-based management interface prior to allowing any administrative access to the TOE.
\r\nThe TOE establishes a trusted path between the ISE and the administrative web-based UI using TLS/HTTPS, and between the ISE and the CLI using SSH. The TOE also establishes a secure connection for sending syslog data to other IT devices using TLS and other external authentication stores using TLS-protected communications. The TOE implements IPsec session capabilities to secure the channel between the TOE and NAS.
","features":[{"id":305,"feature_name":"Asymmetric Key Generation"},{"id":299,"feature_name":"Auditing"},{"id":327,"feature_name":"Authentication Server"},{"id":328,"feature_name":"Certificate Authentication"},{"id":312,"feature_name":"Certificate Validation"},{"id":309,"feature_name":"Cryptographic Hashing"},{"id":306,"feature_name":"Cryptographic Key Establishment"},{"id":308,"feature_name":"Cryptographic Signature Verification"},{"id":302,"feature_name":"DRBG"},{"id":330,"feature_name":"EAP-TLS"},{"id":322,"feature_name":"HTTPS Client"},{"id":1546,"feature_name":"HTTPS Server with Mutual Authentication"},{"id":325,"feature_name":"IKEv1"},{"id":326,"feature_name":"IKEv2"},{"id":324,"feature_name":"IPsec"},{"id":301,"feature_name":"Key Destruction"},{"id":310,"feature_name":"Keyed-hash message authentication"},{"id":321,"feature_name":"SSH Server"},{"id":315,"feature_name":"TLS 1.2"},{"id":318,"feature_name":"TLS Client"},{"id":313,"feature_name":"TLS Server with Mutual Authentication"},{"id":304,"feature_name":"Virtual Network Device"}]}