JAMF Pro 11 Intergration with Cisco ISE 3.2

Thanks, 

Can you also help me with some links and also does JAMF server need import Cisco ISE CA.

Yes, it supports it - however, it's we found it seems very finicky depending on the ISE patch version.

Have you started through the instructions?  https://learn.jamf.com/en-US/bundle/technical-articles/page/Integrating_Jamf_Pro_with_Cisco_ISE_3-1.html

I suspect your network engineer will be able to handle the heavy lifting.  

Yes, Jamf Pro should be able to integrate with the minor versions (3.1, 3.2, etc.) of Cisco ISE 3. Our last technical document published was when 3.1 was the latest minor version. Cisco also publishes their own integration guides for using Jamf that can be found on their site: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/220802-integrate-ise-3-3-with-jamf-as-mdm-serve.html

Hi!
Is it possible to use this integration via VPN?
Based on our findings ISE is always trying to look for certificate fields, but those fields are not available during a VPN, where ISE receives only RADIUS traffic from the firewall. The certificate itself is validated by the ASA, and the GUID from the certificate is used as the RADIUS username.

Then, it falls back to the mac address, but that is the anyconnect generated virtual interface mac address, not the system mac address, so JAMF can’t identity the device.

PS: I posted nearly the exact same question in the Cisco community, maybe they have a workaround/solution for the problem.

Regards,

Norbert