ISE Provisioning and Patching

Ansible playbooks for doing initial ISE provisioning, password reset, patching, deployment, configuration, and backup.

Quick Start

Clone this repository:

git clone https://github.com/1homas/ISE_Provisioning_and_Patching.git

Create your Python environment and install Ansible:

pip install --upgrade pip
pipenv install --python 3.9                     # use Python 3.9 or later
pipenv install bcrypt passlib                   # Python packages required password & SSH keys
pipenv install paramiko                         # ISE SSH/CLI access
pipenv install ansible ciscoisesdk jmespath     # Ansible packages
pipenv install boto3 botocore                   # Python packages for AWS 
pipenv shell

⚠ Installing Ansible using Linux packages (sudo apt install ansible) may result in a much older version of Ansible being installed. 💡 Installing Ansible with Python packages will get you the latest. 💡 If you have any problems installing Python or Ansible, see Installing Ansible.

Export your AWS and ISE and any other credentials or tokens into your terminal environment:

export ISE_REST_USERNAME=admin
export ISE_REST_PASSWORD=ISEisC00L
export ISE_VERIFY=False
export ISE_DEBUG=False
export ISE_RADIUS_SECRET=ISEisC00L
export ISE_TACACS_SECRET=ISEisC00L

Typically it is easier to maintain these variables in files in your ~/.secrets directory then source them when needed:

source ~/.secrets/aws.sh
source ~/.secrets/ise_aws.sh
source ~/.secrets/ise_repository.sh

Variables

Edit the vars_files list in 1_provision--ask-pass.yaml to determine which ISE deployment size (standalong, small, medium, large) you will provision. You may also edit the respective vars/ise_deployment_*.yaml files to customize your ISE node names, roles, services, IP addresses, etc.

Edit the project and deployment settings in vars/main.yaml to match your environment and preferences:

Variable	Description
project_name	Use this as a tag for your cloud resources. Useful for filtering on all resources for this project versus others you may be running. Also used as the default SSH Key passphrase.
owner	Your name or email to identify who is responsible for these cloud resources
domain_name	Used for ISE FQDN naming and AWS Route53 DNS updates.
ise_image	The ISE AMI ID. See https://cs.co/ise-aws to customize this for your desired ISE version and your region(s).
ise_instance_type_default	See https://cs.co/ise-scale for the available instance types/sizes you may run.
ise_security_group_default	The name of the security group to apply to the ISE nodes
timezone	Your preferred timezone for the ISE nodes
ntp_server	Your preferred time server
dns_server	Your preferred DNS Server IP address
ise_init_password	The initial password to provision the ISE nodes with
ise_username	The ISE REST username to use for API-based operations
ise_password	The ISE REST password to use for API-based operations
ise_verify	Use certificate validation (true) or not (false)
ise_debug	Enable debugging (true) or not (false)
ise_radius_secret	Your primary RADIUS secret
ise_tacacs_secret	Your primary TACACS secret

Run an Ansible playbook:

💡 The --ask-pass option will have Ansible ask you to type the SSH Key passphrase to use it for the password reset command. The default SSH Key passphrase is the project_name.

ansible-playbook 1_provision--ask-pass.yaml --ask-pass
ansible-playbook 2_ise_facts.yaml
ansible-playbook 3_patch.yaml
ansible-playbook 4_deployment.yaml
ansible-playbook 5_configuration.yaml
ansible-playbook 6_backup_now.yaml
ansible-playbook 7_destroy.yaml

License

This repository is licensed under the MIT License.