;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubRead and declaratively manage network devices and endpoints in Cisco Identity Services Engine (ISE) from any Windmill script, flow or app, through the ERS API.
Set up in 3 steps
Enable ERS on ISE
In ISE, open Administration > System > Settings > API Settings and turn on ERS (Read/Write). Create an admin user in the ERS Admin group, or ERS Operator for read-only use. Use a dedicated service account rather than a person's account.
Add the resource
Open Resources, click Add a resource and pick Cisco ISE. Enter the address of the Primary Administration Node, the user and the password. Leave the ERS port empty to use 443, or set 9060 for ISE's dedicated ERS port.
Run your first script
Start with List network devices to check the connection. The upsert scripts default to dry run: they return the difference with ISE and change nothing until you set dry_run to false.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Upsert network device
Upsert endpoint
List network devices
List identity groups
List endpoints
Get network device
Get endpoint by MAC
Resource type
The shape of the credential every script on this page expects.
cisco_ise
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| base_url | string | Yes | HTTPS address of the ISE Primary Administration Node, e.g. https://ise.example.com. No trailing slash. The certificate must match this address and be trusted by the Windmill worker (DENO_CERT or SSL_CERT_FILE): a default self-signed certificate is rejected. |
| ers_port | integer | No | Port of the ERS API. Leave empty to use the port in the base URL (443 by default). Set 9060 to use ISE's dedicated ERS port. |
| username | string | Yes | ISE admin user in the ERS Admin (read/write) or ERS Operator (read-only) group. |
| password | string | Yes | Password of the ISE admin user. |
Questions
Do I need to disable TLS verification for a self-signed ISE certificate?
No. Add your private CA to the trust store of the Windmill workers that run these scripts.
What does an upsert do when the object does not exist?
It creates it. A new network device needs at least one IP address, and a new endpoint needs an identity group. Fields you leave empty are not managed and stay as they are in ISE.