Introduction

Network as Code allows for complete separation of data (defining variables) from logic (infrastructure declaration). With little to no knowledge about automation, users can configure Cisco ISE identity, network access, and TrustSec policy in minutes, using the same constructs familiar from the ISE GUI. This is achieved by separating the *.yaml files which contain the desired ISE state from the Terraform Modules which map the definition of the desired state to Terraform resources. The data model and modules used in Network as Code are open-source and available as-is. For support and or customization it is required to engage with Cisco Professional Services.

The tree output below shows an example of a data model where the *.yaml files compose logical groups that map to the sections ISE users are already familiar with from the admin portal.

• Directorydata

  • system.nac.yaml
  • identity_management.nac.yaml
  • network_resources.nac.yaml
  • network_access.nac.yaml
  • trust_sec.nac.yaml
• main.tf

Configuration can simply be managed via YAML files. Below is a simple example defining a network device that will authenticate against ISE via RADIUS:

---
ise:
  network_resources:
    network_devices:
      - name: Router1
        ips:
          - ip: 10.1.2.3
        radius:
          shared_secret: Cisco123

ISE Provider

Unlike device-based providers that connect over NETCONF or NX-API, the Terraform provider for ISE manages configuration on a single ISE Policy Administration Node (PAN) over its REST APIs. Both the ERS and Open API services must be enabled before Terraform can communicate with it:

1. Navigate to Administration -> Settings -> API Settings.
2. Under API Service Settings, enable ERS (Read/Write) and Open API (Read/Write).
3. Click Save.

Network as Code for ISE Module

The Network as Code Terraform module for ISE is responsible for mapping the data to the corresponding ISE resources. This module supports an inventory driven approach, where a complete ISE configuration or parts of it are modeled in one or more YAML files, organized under the same six sections as the ISE Data Model: identity_management, network_resources, network_access, device_administration, trust_sec, and system.

The simple example repository is a good starting point for a single-resource deployment, while the comprehensive example repository demonstrates a full ISE configuration spanning all six sections.

Additional services

Cisco Customer Experience (CX) is able to help you with many additional services such as CI/CD integration, pre-change validation, integration with Information Technology Service Management (ITSM), as well as automated testing. Please reach out to your Cisco account team for more information.