DXL includes an extension that enables you to bridge a DXL broker fabric and pxGrid infrastructure. For details about Cisco pxGrid, see: https://www.cisco.com/c/en/us/products/security/pxgrid.html. DXL-integrated technologies can share information between any product that uses pxGrid and any product that uses DXL. For example, system information about malware identified by McAfee technologies on managed endpoints can be shared through DXL to the Cisco pxGrid infrastructure, which allows Cisco ISE to quarantine the affected endpoints.

To set up DXL with Cisco pxGrid, click to expand the section you want to view:

Provision certificates in Cisco ISE for use with DXL brokers

Cisco ISE version 2.2 and later:

1. Identify the brokers that you want to connect to Cisco pxGrid.
2. Log on to the ISE web user interface as an Administrator and navigate to Administration, pxGrid Services, Certificates.
3. In the "I want to" drop-down list, select Generate a single certificate (without a certificate signing request).
4. Type the common name and certificate passwords.
   
   IMPORTANT: Use the same certificate passwords when you configure pxGrid in DXL (Server Settings, DXL Cisco pxGrid Settings).


5. In the "Certificate Download Format" field, select Certificate in Privacy Enhanced Electronic Mail (PEM) format and click Create.
6. Copy the downloaded .zip file into the broker in this folder:
   
   /var/mcafee/dxlbroker/ipe/cisco/keystore
   
   NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.


7. Repeat the previous steps for each broker that you want to connect to pxGrid.
8. In the "I want to" drop-down list, select Download root certificate chain and choose all hosts names.
9. In the "Certificate Download Format field," select Certificate in Privacy Enhanced Electronic Mail (PEM) format and click Create.
10. Copy the downloaded .zip file into the broker in this folder:
    
    /var/mcafee/dxlbroker/ipe/cisco/truststore
    
    Repeat for each broker that connects to pxGrid.
    
    NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.

See also:

• Using ISE 2.2 Internal CA (CA) to Deploy Cisco pxGrid clients (not using external CA): https://communities.cisco.com/docs/DOC-71928
• Deploying pxGrid in ISE Productional Environments (version 2.0) section Deploying pxGrid using ISE 2.2+ (using external CA): https://communities.cisco.com/docs/DOC-68284

Cisco ISE version 2.1:

1. Identify the brokers that you want to connect to Cisco pxGrid.
2. Log on to the ISE web user interface as an Administrator and navigate to the Certificate Provisioning Portal, Device Portal Management, Certificate Provisioning.
3. Navigate to the Certificate Provisioning Portal Default, and select the Portal Test URL.
4. Provide the requested credentials and click Sign On.
5. In the "I want to" drop-down list, select Generate a single certificate (without a certificate signing request).
6. Provide the Common Name (CN).
   
   NOTE: The CN must be a resolvable fully qualified domain name (FQDN) of a broker system.
    
7. Provide the MAC address and certificate passwords.
   
   IMPORTANT: You must use the same certificate passwords when you configure pxGrid in DXL (Server Settings, DXL Cisco pxGrid Settings).
    
8. In the "Certificate Download Format field," select Certificate in PEM format and click Generate.
9. Extract the contents of the downloaded .zip file to a temporary folder.
10. Copy all individual files from the temporary folder into the broker in the following folder:
    
    /var/mcafee/dxlbroker/ipe/cisco/keystore
    
    NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.
     
11. Copy only the CertificateServicesRootCA-xxx.cer file and the external root certificate file, caroot.cer, from the temporary folder into the broker in the following folder:
    
    /var/mcafee/dxlbroker/ipe/cisco/truststore
    
    NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.
     
12. Repeat steps 5–11 for each broker you want to connect to pxGrid.

See also:

• Using ISE 2.1 Internal CA (CA) to Deploy Cisco pxGrid clients (not using external CA): https://communities.cisco.com/docs/DOC-71927
• Deploying pxGrid in ISE Productional Environments (version 2.0) section Deploying pxGrid using ISE 2.1 with Internal CA and External CA certificates for ISE nodes: https://communities.cisco.com/docs/DOC-68284

Cisco ISE version 2.0:

1. Identify the brokers that you want to connect to Cisco pxGrid.
2. Download and install OpenSSL for Windows from the following location, and select the Win32 OpenSSL Light (for 32-bit) or Win64 OpenSSL Light (for 64-bit) package:
   
   http://www.slproweb.com/products/Win32OpenSSL.html
   
   If the message "Critical component is missing: Microsoft Visual C++ 2008 Redistributables" displays, cancel the setup and download one of the following packages (based on your architecture):
   
   Visual C++ 2008 Redistributables (x86), available at:
   http://www.microsoft.com/downloads/details.aspx?familyid=9B2DA534-3E03-4391-8A4D-074B9F2BC1BF
   
   Visual C++ 2008 Redistributables (x64), available at:
   http://www.microsoft.com/downloads/details.aspx?familyid=bd2a6171-e2d6-4230-b809-9a8d7548c1b6


3. Open a command prompt (Start, Run, cmd.exe), and set the following OpenSSL environment variables. Adjust the OpenSSL path based on your install location:
   
   C:\>set OPENSSL_BIN=c:\OpenSSL-Win32\bin
   C:\>set PATH=%OPENSSL_BIN%;%PATH%
   C:\>set OPENSSL_CONF=%OPENSSL_BIN%\openssl.cfg


4. Create and change to the directory for output files:
   
   C:\>mkdir c:\certificates
   C:\>cd c:\certificates


5. Create a private key and set a password for it. Make sure that the same password is set in McAfee ePO Server Settings, DXL Cisco pxGrid Settings page.
   
   IMPORTANT: Use the same certificate passwords when you configure pxGrid in DXL (Server Settings, DXL Cisco pxGrid Settings).
   
   C:\certificates>openssl genrsa -aes256 -out tmp.key 2048
   
   Generating RSA private key, 2048 bit long modulus
   .....................................................................................+++
   ..............+++
   e is 65537 (0x10001)
   Enter pass phrase for tmp.key:
   Verifying - Enter pass phrase for tmp.key:


6. Convert the key to PCKS8 type:
   
   C:\certificates>openssl pkcs8 -in tmp.key -topk8 -out pxgrid_client.key -v1 PBE-SHA1-3DES
   
   Provide the same password as before and make sure that the Encryption Password is set with the same value:
   
   Enter pass phrase for tmp.key:
   Enter Encryption Password:
   Verifying - Enter Encryption Password:


7. Generate the certificate signing request from that key.
   
   C:\certificates>openssl req -out pxgrid_client.csr -key pxgrid_client.key -new
   
   Type the needed information. Make sure that a unique value is provided for "Common Name." For example, the DXL broker’s host name:
   
   Enter pass phrase for pxgrid_client.key:
   You are about to be asked to enter information that will be incorporated into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [AU]:.
   State or Province Name (full name) [Some-State]:.
   Locality Name (eg, city) []:.
   Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
   Organizational Unit Name (eg, section) []:.
   Common Name (e.g. server FQDN or YOUR name) []:DXLBroker1.dxl.lab
   Email Address []:.
   
   Type the following 'extra' attributes to be sent with your certificate request:
   
   A challenge password []:
   An optional company name []:


8. Sign the certificate, and import the CA in the Cisco ISE:
   • Option 1: Use an external CA to sign the certificate:
     1. Provide the CSR file to the CA vendor and get back the signed pxgrid_client.cer.
        
        NOTE: The CA server using a customized template must sign the CSR request. This customized template must contain an EKU of both client authentication and server authentication.
        
        As a reference, see Deploying Certificates with Cisco pxGrid-Using an external Certificate Authority (CA) with updates to Cisco ISE 2.0/2.1/2.2 in section Using an External Certificate CA Server Customized Template (https://communities.cisco.com/docs/DOC-71926).
     2. Copy pxgrid_client.key and pxgrid_client.cer into the broker in this folder:
        
        /var/mcafee/dxlbroker/ipe/cisco/keystore
        
        NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.
     
     
     3. Break down the certificate chain of the CA into separate PEM files and copy those files into broker under folder /var/mcafee/dxlbroker/ipe/cisco/keystore (the root CA certificate). These files have the extension .cer.
        
        NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.
     
     
     4. Log on to the ISE web user interface as an Administrator and navigate to Administration, System, Certificates, Certificate Management, Trusted Certificates.
     5. Click Import and select the CA certificate files you created in step 8c.
        
        Use the default values and import for each file.
   
   
   • Option 2: Use a self-signed CA:
     1. Create CA certificate and key with the following command:
        
        c:\certificates>openssl req -new -x509 -days 365 -extensions v3_ca -keyout ca.key -out ca.cer
        
        Type the needed information. Make sure "Common Name" is unique, and is set to the FQDN of the DXL broker:
        
        Generating a 2048 bit RSA private key .............................................................................+++
        ....................+++
        writing new private key to 'ca.key'
        Enter PEM pass phrase: Verifying - Enter PEM pass phrase:
        -----
        You are about to be asked to enter information that will be incorporated into your certificate request.
        What you are about to enter is what is called a Distinguished Name or a DN.
        There are quite a few fields but you can leave some blank
        For some fields there will be a default value,
        If you enter '.', the field will be left blank.
        -----
        Country Name (2 letter code) [AU]:.
        State or Province Name (full name) [Some-State]:.
        Locality Name (eg, city) []:.
        Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
        Organizational Unit Name (eg, section) []:.
        Common Name (e.g. server FQDN or YOUR name) []:DXLpxGridClientsCA
        Email Address []:.
     
     
     2. Sign the CSR with the following command:
        
        c:\certificates>openssl x509 -req -in pxgrid_client.csr -CA ca.cer -CAkey ca.key -CAcreateserial -out pxgrid_client.cer -days 365
        
        Type the password for CA key and complete signing the certificate:
        
        Signature ok
        subject=/CN=DXLBroker1.dxl.lab
        Getting CA Private Key
        Enter pass phrase for ca.key:
     
     
     3. Copy pxgrid_client.cer, pxgrid_client.key, and ca.cer to the broker in the folder:
        
        /var/mcafee/dxlbroker/ipe/cisco/keystore
        
        NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.
     
     
     4. Log on to the ISE web user interface as an Administrator and navigate to Administration, System, Certificates, Certificate Management, Trusted Certificates.
     5. Click Import and select the c:\certificates\ca.cer file. Use the default values and import.


9. Repeat steps 5–8 for each broker that connects to pxGrid.
   
   If you use a self-signed CA, you can reuse the same CA for signing certificate requests, but you must generate separate certificates for each broker.


10. In the ISE web user interface, navigate to Administration, System, Certificates, Certificate Management, System Certificates.
11. Select the certificate entry that is "used by" pxGrid. Make a note of the "Issued by" value, and click Export.
12. Select Export certificate only and click Export.
13. For each DXL broker that connects to pxGrid, copy the downloaded file onto the broker in the folder:
    
    /var/mcafee/dxlbroker/ipe/cisco/truststore
    
    NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.


14. In the ISE web user interface, navigate to Administration, System, Certificates, Certificate Management, Trusted Certificates.
15. Select the entry where "Issued to" is same as the "Issued by" value in step 11 and click Export.
16. For each DXL broker that connects to pxGrid, copy the downloaded file to the DXL broker in the folder:
    
    /var/mcafee/dxlbroker/ipe/cisco/truststore
    
    NOTE: An SCP or SFTP tool is needed to copy the .zip file to the DXL broker.

See also:

• Deploying Certificates with Cisco pxGrid- Using Self-Signed Certificates Updates to Cisco ISE 2.0/2.1/2.2: https://communities.cisco.com/docs/DOC-71925

Back to Top

Configure the Cisco pxGrid settings in DXL using McAfee ePO

Provide the information needed for DXL brokers to connect to the Cisco pxGrid fabric.

1. In ePO, select Menu, Configuration, Server Settings, DXL Cisco pxGrid, then click Edit.
2. Complete the settings on the Edit DXL Cisco pxGrid page:

   Field	Description
   pxGrid Hosts	Enter the host name or IP address for the pxGrid controllers that the DXL brokers connect to.
   Client Name Prefix	This field identifies the name of the client connection from the DXL brokers to the pxGrid fabric in the Cisco ISE console. You can change this name, and it is updated in the pxGrid user interface.
   Client Description	This field identifies the description of the client connection from the DXL brokers to the pxGrid fabric in the Cisco ISE console. You can change this description, and it is updated in the pxGrid user interface.
   Client Groups	Specifies the group capabilities for which the DXL brokers bridging to Cisco pxGrid are requesting access. If you do not want a capability to be available through the bridge between DXL and Cisco pxGrid, click the minus icon to remove it. To enter a new capability, click the plus icon.
   Certificate Password	The password used to create the certificate in Cisco ISE for use with DXL.
   Notifications	Notifications are received through the pxGrid fabric. Select the types of notifications to bridge from the pxGrid fabric to DXL.
   Session Notification Subnet Filter	Receive session notifications from specific subnets. Leave this field empty to receive session notifications for all subnets, or enter a comma-separated subnet address to receive notifications only from those subnets. For example: 1.0.0.0/255.0.0.0,1234::/16

Configure the DXL brokers to use with Cisco pxGrid using McAfee ePO

Select which DXL brokers to bridge with the Cisco pxGrid fabric. Perform the following steps for each broker that is used with Cisco pxGrid.

1. In ePO, select Menu, Configuration, Server Settings, DXL Topology, then click Edit.
2. Select a broker to use with Cisco pxGrid.
3. Select one or more broker extensions to use.
   
   You can have several DXL brokers that query Cisco pxGrid providers, but only choose one broker to receive notifications, to reduce redundancy and to prevent performance issues.

Approve Cisco pxGrid connections from DXL brokers in Cisco ISE

When a DXL broker connects to pxGrid for the first time, it might be put in a Pending approval state in Cisco ISE. Before the DXL broker can communicate with pxGrid, the ISE Administrator must approve the DXL connection:

1. Log on to the ISE web user interface as an Administrator and navigate to Administration, pxGrid Services, Clients.
   
   NOTE: Newer versions of ISE use the name "All Clients" instead of Clients.


2. Select the client names that correspond to the brokers selected for Cisco pxGrid connectivity, and whose status is Pending.
3. Click Approve and confirm the approval process.
   
   The status for the DXL broker connection changes to Online.

Set up automatic responses in McAfee ePO (Optional)

You can create an automatic response to send a mitigation action to Cisco pxGrid, or to apply an Adaptive Network Control (ANC) endpoint policy when a threat event occurs. ANC policies are created in Cisco ISE. For example, if you created an automatic response rule with Quarantine as the mitigation action for a system, the system the threat event was for is quarantined in Cisco ISE when a threat event occurs.

Automatic responses are created in ePO using the Automatic Responses feature. In the Actions page of the Response Builder, select Execute pxGrid Query, then select the query type, system identifier, and either the action to take or the policy to apply.