Let me start with a list of things that are required:
- Access to Cisco, via GUI and CLI as admin
- SFTP server + user, and root access
- Network access: ISE > SFTP server over TCP/22 (SSH - as SFTP transfers data over it)
My setup is explained in the next section.
Some prior Linux knowledge will help you, but I've tried to keep it as simple as possible with additional explanations.
I've replaced some internal data with dummy data. You can find the overview here.
Cisco ISE, Version 188.8.131.528, ADE-OS Version 184.108.40.206, VM cluser.
Ubuntu 22.04.3 LTS as SFTP server accessible via backup-server (10.10.10.10). The user account for the backups is called
Mysecureshell was used to set it up. The backups will be saved in the home directory of said user under
More specific information will follow. Keep in mind that some configurations might change depending on your setup.
On the ISE, we are mainly working within these two menues.
SFTP Server - Create a backup directory on the SFTP server
We are going to save the backups in the home directory of the SFTP user
ise. We are going to switch to said directory as root and, create a new directory for the backups, and change the necessary permissions.
- Switch to home directory of user
root@backup-server:# cd /home/ise/
- Create a new directory:
root@backup-server:# mkdir ise-bk-new
- Change ownership from
root@backup-server:# chown ise:ise ise-bk-new
- Change permissions of directory:
root@backup-server:# chmod 755 ise-bk-new
- user: read (r) 4, write (w) 2, execute (x) 1
- group: read (r) 4, execute (x) 1
- others: read (r) 4, execute (x) 1
You can confirm the changes with
root@backup-server:# ll drwxr-xr-x 2 ise ise 4096 Okt 1 01:11 ise-bk-new
ISE GUI - Create new repository
Open the GUI of the ISE as an admin and go to the following menu:
System > Maintenance > Repository.
+Add and choose
SFTP as the protocol.
Choose a name for the repository, enter the IP or hostname of the SFTP server and the Path relative to the home directory of the SFTP user
ise. As a side note: I haven't checked if the full absolute paths would work too.
Finally, enable PKI authentication by checking the box for
Enable PKI authentication, enter the SFTP user and keep the password field empty as we will use a public key for authentication.
Click save to confirm the creation.
ISE GUI - Create a new key pair for GUI user
Right after, we create a key pair for this repository/ GUI user and export the public of that key pair.
Choose the new repository, click on
+ Generate Key pairs, and choose a strong passphrase.
Don't forget to store that passphrase in a secure place!
Next, we will export the public key by choosing the repository again and clicking
Export public key. Save it somewhere on your computer for now; we are going to need it later.
ISE CLI - Add SFTP server host key to ISE
Next, open the CLI of the ISE as
- Add the host key of the SFTP server to the ISE with the following command:
crypto host_key add host ipAddressOrHostnameOfTheSFTPServer
Important: the IP or hostname must match the
Server Namethat has been specific in the repository in a previous section!
- You can check if the host key was added with:
show crypto host
ISE CLI - Create a second key pair in CLI
We now have to create another key pair.
- Create key pair for in CLI:
crypto key generate rsa passphrase ReallyStrongAndSecurePassphrase
- Again, save this passphrase in a secure place as well
We now have to export this public key to a local repository and can download it via ISE GUI.
- Export key to the local disk:
crypto key export ChooseNameForPublicKey repository LOCALDISK
ChooseNameForPublicKey- just in case, replace with a random name
LOCALDISK- name of the local repository on ISE
Now you need to download the second public key in the GUI under
System > Maintenance > Localdisk Management.
Save it to your computer.
SFTP Server - change SSH server configuration
So, from my experience, most SSH servers have authentication via public key disabled by default. We have to check it and might have to change some configurations.
We want to modify the configuration file of the SSH server to enable public key authentication. The default file is
/etc/ssh/sshd_config, and sudo permissions are required.
Side note: Depending on your environment, it is not recommended to change the default configuration file as some management solutions or servers could overwrite them regularly. You could create a new
.conf file in the
/etc/ssh/sshd_config.d/ directory to keep the ISE configuration separate. Just make sure that the reference to this directory is present in the default configuration file:
Open the configuration file in your favorite text editor and change or add the file according to the following options.
- Enable public key authentication:
- Enable RSA authentication:
- Make sure that the
authorized_keysfile is included:
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 ~/.ssh/authorized_keys
Important: Don't forget to remove the leading
# as it marks the whole line as a comment and will be ignored by the server!
Restart the SSH server with
sudo systemctl restart sshd - which should be the default way to run your SSH server.
Side note: Depending on your version of the SSH server, you have to accept RSA keys with:
HostkeyAlgorithms +ssh-rsa PubkeyAcceptedAlgorithms=+ssh-rsa HostKey /etc/ssh/ssh_host_rsa_key
As a reference and troubleshooting tips: SSH - How to use public key authentication on Linux
SFTP Server - add public keys to authorized_keys file
So, we've created our key pairs on the ISE. We now have to make sure that the SFTP server trusts these.
To make this happen, we have to add the previously downloaded public keys to the
authorized_keys file of the user
ise. You can find the file in the
.ssh directory in the home directory of the user.
Important: If it does not exist, you have to create it and make sure that the permissions are right.
sudo chmod 700 /home/ise/.ssh # permission of the .ssh directory sudo touch /home/ise/.ssh/authorized_keys # create file sudo chown ise:ise /home/ise/.ssh/authorized_keys # set file ownership sudo chmod 644 /home/ise/.ssh/authorized_keys # set file permissions
Now, we have to add the content of the public keys into the
authorized_keys file. One key per line!
You can use the CLI text editor
nano to do so, but feel free to use your favorite method. Alternatives: WinSCP,
ISE GUI - Test your setup
There are two simple ways to confirm that it is working.
First, on ISE GUI, on the page with the repositories, you can choose the new repository and click
Verify to make sure that the communication with the SFTP server is possible.
The second option would be to create a manual backup. Visit
System > Administration > Backup & Restore
Configuration Data Backup, and click on
Backup Now. In the pop-up window, choose a name, the new repository, a secure passphrase and click on
The status and result of the backup are present on the same page:
This should do the trick! - I created this guide sometime after the implementation, so feel free to let me know if I missed anything.
Additionally, I'd like to share some other articles that might help to troubleshoot and harden the system:
No order, just a bookmark dump of the day of the implementation:
- 16.02.2024 forum.ittavern.com - Thoughts & Ideas
- 04.02.2024 Adding a trash can to Linux with trash-cli
- 20.01.2024 Bandwidth Measurement using netcat on Linux
- 14.01.2024 Getting started with rsync - Comprehensive Guide
- 10.01.2024 Cron Jobs on Linux - Comprehensive Guide with Examples