ISE Commands

# List all endpoints
netapi ise get-endpoints

# Get endpoint by MAC address
netapi ise get-endpoint C8:5B:76:C6:59:62

# JSON output for jq processing
netapi ise --format json get-endpoint C8:5B:76:C6:59:62 | jq

# List all endpoint identity groups
netapi ise get-endpoint-groups

# List all identity groups
netapi ise get-identity-groups

# Create a new identity group
netapi ise create-identity-group "Linux-Research-Workstations" \
    --description "Linux research workstations - certificate-based identity for EAP-TLS"

# Create with parent group
netapi ise create-identity-group "Research-Linux" \
    --parent "User Identity Groups" \
    --description "Research Linux machines"

# Delete identity group
netapi ise delete-identity-group "Test-Group"

# Force delete (no confirmation)
netapi ise delete-identity-group "Test-Group" --force

# List all NADs
netapi ise get-nads

# Get specific NAD by name
netapi ise get-nad "SW-CORE-01"

# List all SGTs
netapi ise get-sgts

# Get specific SGT by name
netapi ise get-sgt "Employees"

# List all authorization profiles
netapi ise get-authz-profiles

# Get specific profile by name
netapi ise get-authz-profile "PermitAccess"

# Update authorization profile VLAN or DACL
netapi ise update-authz-profile "ProfileName" --vlan ADMIN_VLAN --dacl "PERMIT_ALL"

# Remove dACL from profile (for troubleshooting)
netapi ise update-authz-profile "ProfileName" --no-dacl

# List all DACLs
netapi ise get-dacls

# Get specific DACL by name
netapi ise get-dacl DACL_ADMIN_FULL

# List ISE deployment nodes
netapi ise get-nodes

# List all network access policy sets (shows conditions)
netapi ise get-policy-sets

# Get specific policy set by name
netapi ise get-policy-set "Corp WIFI"
netapi ise get-policy-set "Wired Dot1X Closed"

# Fetch groups from iPSKManager ODBC source
netapi ise get-odbc-groups iPSKManager

# With explicit browser session (if auto-login fails)
netapi ise get-odbc-groups iPSKManager --session "APPSESSIONID=..." --csrf "..."

# List all certificate authentication profiles
netapi ise get-cert-profiles

# Get specific profile details
netapi ise get-cert-profile AD_Cert_Profile

# Create new certificate profile
netapi ise create-cert-profile Windows_Cert_Profile \
    --desc "Windows EAP-TLS/TEAP authentication" \
    --attr SUBJECT_COMMON_NAME

# Create profile using SAN (Subject Alternative Name)
netapi ise create-cert-profile Linux_SAN_Profile \
    --desc "Linux with SAN-based identity" \
    --attr SUBJECT_ALTERNATIVE_NAME_DNS

# List allowed protocol services
netapi ise get-allowed-protocols

# Get EAP method details for a protocol service
netapi ise get-allowed-protocol "Default Network Access"

EAP-TLS            enabled    # Certificate-based - GOOD
EAP-TEAP           enabled    # Tunneled EAP - check inner methods
PEAP               enabled    # Legacy - check inner methods
TEAP-EAP-TLS       enabled    # Cert in tunnel - GOOD
TEAP-MSCHAPv2      enabled    # PASSWORD - DISABLE THIS

# Run full policy audit (console output)
netapi ise audit

# Save audit to JSON file
netapi ise audit --output /tmp/ise-audit.json

# Audit with JSON output for processing
netapi ise audit --format json | jq '.[] | select(.policy_set == "Wired Dot1X Closed")'

# List all rejected endpoints
netapi ise get-rejected-endpoints

# Release a rejected endpoint (allow new auth attempts)
netapi ise release-rejected 14:F6:D8:7B:31:80

# Move endpoint to different identity group
netapi ise update-endpoint-group C8:5B:76:C6:59:62 Blacklist

# Move with non-static assignment (allows re-profiling)
netapi ise update-endpoint-group C8:5B:76:C6:59:62 Profiled --no-static

# List all ANC policies
netapi ise get-anc-policies

# List endpoints with ANC policies applied
netapi ise get-anc-endpoints

# Apply ANC policy (quarantine, shutdown, port bounce)
netapi ise anc-apply C8:5B:76:C6:59:62 Quarantine

# Clear ANC policy from endpoint
netapi ise anc-clear C8:5B:76:C6:59:62

# List all active RADIUS sessions
netapi ise mnt sessions

# Get session count
netapi ise mnt count

# Get session by MAC address
netapi ise mnt session C8:5B:76:C6:59:62

# Get session by IP address
netapi ise mnt session-ip 10.50.40.100

# Get session by username
netapi ise mnt session-user jsmith

# Get recent authentication attempts
netapi ise mnt auth-logs

# Get authentication status for a MAC
netapi ise mnt auth-status C8:5B:76:C6:59:62

# Get failed authentication attempts
netapi ise mnt failed

# List failure reason codes
netapi ise mnt failure-reasons

# Send CoA to endpoint (reauthenticate, bounce, etc.)
netapi ise mnt coa C8:5B:76:C6:59:62 --action reauthenticate

# Get ISE version information
netapi ise mnt version

# Test DataConnect Oracle connection
netapi ise dc test

# Get authentication statistics
netapi ise dc stats

# List endpoints from DataConnect
netapi ise dc endpoints

# Get endpoint details
netapi ise dc endpoint C8:5B:76:C6:59:62

# Get recent authentications (last hour, all statuses)
netapi ise dc recent

# Get recent authentications (last 4 hours)
netapi ise dc recent --hours 4

# Get only successful authentications
netapi ise dc recent --status passed

# Get only failures (same as dc failed)
netapi ise dc recent --status failed

# Get failed authentications (last 24 hours, detailed)
netapi ise dc failed
netapi ise dc failed --hours 48 --limit 200

# Get endpoint counts by profiler policy
netapi ise dc profiler

# Get endpoint counts by device type
netapi ise dc device-types

# Execute raw SQL query (use with caution)
netapi ise dc query "SELECT * FROM radius_authentication WHERE timestamp > SYSDATE - 1"

netapi ise mnt --format json sessions | \
  jq -r '.[] | select(.vlan=="40") | [.calling_station_id, .framed_ip_address] | @tsv'

netapi ise mnt --format json sessions | \
  jq -r 'group_by(.nas_ip_address) | map({nad: .[0].nas_ip_address, count: length}) | .[]'

netapi ise dc --format json stats | \
  jq -r '"Auth: \(.total) total, \(.passed) passed, \(.failed) failed"'

MAC="C8:5B:76:C6:59:62" && \
  netapi ise mnt --format json session $MAC | jq '{ip: .framed_ip_address, vlan: .vlan}' && \
  netapi ise --format json get-endpoint $MAC | jq '{desc: .description}'

netapi ise mnt --format json sessions | \
  jq -r '["MAC","IP","Username","NAD","VLAN"], (.[] | [.calling_station_id, .framed_ip_address, .user_name, .nas_ip_address, .vlan]) | @csv'

for cmd in version count sessions; do
  echo "=== ise mnt $cmd ==="
  uv run netapi ise mnt $cmd 2>&1 | head -20
  echo
done

for cmd in test stats profiler device-types; do
  echo "=== ise dc $cmd ==="
  uv run netapi ise dc $cmd 2>&1 | head -20
  echo
done

for cmd in get-endpoints get-endpoint-groups get-nads get-sgts get-authz-profiles get-dacls get-nodes get-policy-sets; do
  echo "=== ise $cmd ==="
  uv run netapi ise $cmd 2>&1 | head -20
  echo
done

for ps in 'Corp WIFI' 'HomeRF WPA2PSK' 'Corp LAN MAB' 'Wired Dot1X Closed' 'IoT WIFI iPSK' 'Guest WIFI'; do
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "Policy Set: $ps"
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  uv run netapi ise get-policy-set "$ps" 2>&1 | head -30
  echo
  echo "--- Authentication Rules ---"
  uv run netapi ise get-auth-rules "$ps" 2>&1 | head -15
  echo
  echo "--- Authorization Rules ---"
  uv run netapi ise get-authz-rules "$ps" 2>&1 | head -15
  echo
done

echo "╔════════════════════════════════════════════════════════════════════╗"
echo "║                    ISE RECONNAISSANCE REPORT                       ║"
echo "╚════════════════════════════════════════════════════════════════════╝"
echo

echo "=== MnT Version ==="
uv run netapi ise mnt version
echo

echo "=== Active Sessions ==="
uv run netapi ise mnt count
echo

echo "=== DataConnect Stats ==="
uv run netapi ise dc stats
echo

echo "=== Policy Sets ==="
uv run netapi ise get-policy-sets
echo

echo "=== Authorization Profiles ==="
uv run netapi ise get-authz-profiles
echo

echo "=== Downloadable ACLs ==="
uv run netapi ise get-dacls
echo

echo "=== Deployment Nodes ==="
uv run netapi ise get-nodes
echo

echo "=== Profiler Summary ==="
uv run netapi ise dc profiler
echo

echo "=== Device Types ==="
uv run netapi ise dc device-types

MAC="00:50:C2:39:F0:F7"

# [CHECK] Get current session status
netapi ise mnt session $MAC
# Look at: Status (PASSED/FAILED), NAD Name, Port, VLAN assigned

# [CHECK] If FAILED, check authentication history
netapi ise mnt auth-status $MAC

# [CHECK] Get the dACL rules being applied
# Note: Switch shows "xACSACLx-IP-TEST_Medical_Temp_Monitor-697290bb"
# The actual dACL name in ISE is just "TEST_Medical_Temp_Monitor"
netapi ise get-dacl TEST_Medical_Temp_Monitor

# [CHECK] See if endpoint is rejected (anti-RADIUS-spray)
netapi ise get-rejected-endpoints

# [FIX] If rejected, release it
netapi ise release-rejected $MAC

# [CHECK] Recent auth attempts from DataConnect
netapi ise dc recent --hours 1 | grep -i "$MAC"

# === PHASE 1: ISE Investigation ===
MAC="00:50:C2:39:F0:F7"

# [CHECK] Get last known session
netapi ise mnt session $MAC
# Note the NAD IP and Port from output

# [CHECK] If no active session, check auth history
netapi ise mnt auth-status $MAC

# === PHASE 2: Switch Investigation ===
# SSH to the NAD shown in ISE session output
sudo ssh admin@<NAD_IP>

# [MAC Table] Check if endpoint is in CAM table
show mac address address 00:50:C2:39:F0:F7

# [NAS PORT] Check port status
show interfaces GigabitEthernet4/0/11 status

# [ACCESS SESSION] Check 802.1X/MAB session
show access-session interface GigabitEthernet4/0/11 detail

# [PORT CONFIG] Check interface configuration
show run interface GigabitEthernet4/0/11

# === PHASE 3: Remediation ===

# [FIX] If VLAN mismatch (device in wrong VLAN)
conf t
interface GigabitEthernet4/0/11
switchport access vlan 751
exit
exit

# [WAIT] Wait for MAB auth (30-45s if dot1x times out first)
show access-session interface GigabitEthernet4/0/11 detail

# === PHASE 4: Validation ===

# [DONE] Ping from your workstation
ping -c 3 <endpoint_ip>

# [DONE] Confirm via netapi
netapi ise mnt session $MAC

# From ISE
netapi ise get-dacl TEST_Medical_Temp_Monitor

# From switch (shows runtime ACL)
show ip access-list xACSACLx-IP-TEST_Medical_Temp_Monitor-697290bb

# [CHECK] - verification/investigation step
# [FIX]   - remediation action
# [WAIT]  - async step (waiting for dot1x timeout, etc.)
# [DONE]  - validation that fix worked

# [CHECK] Get session from ISE
netapi ise mnt session 00:50:C2:39:F0:F7

# [CHECK] SSH to switch
sudo ssh admin@10.193.144.124

# [CHECK] View access session
show access-session interface GigabitEthernet4/0/11 detail

# [FIX] Correct VLAN assignment
conf t
interface GigabitEthernet4/0/11
switchport access vlan 751
exit

# [WAIT] Wait for MAB re-auth (~30-45s)
show access-session interface GigabitEthernet4/0/11 detail

# [DONE] Validate connectivity
ping -c 3 10.238.1.28