EfficientIP Cisco ISE Integration for Consistent Policy Enforcement

Enterprise access policies depend on accurate, up-to-date information about the devices and users connecting to the network. Yet network and security teams often manage this information across separate systems. Manual updates and reconciliation can create gaps between network reality and the data used to enforce access policies.

The EfficientIP Cisco ISE integration connects SOLIDserver IPAM with Cisco ISE through API-based synchronization. MAC addresses and user information are synchronized from IPAM to Cisco ISE, while Cisco ISE Endpoint Groups and Identity Groups are replicated into SOLIDserver. This creates a consistent flow of information between NetOps and SecOps, helping reduce manual work, improve traceability, and support more consistent, identity-based policy enforcement as the network changes.

3 Key Takeaways

1. Keep network and security data aligned automatically

Synchronize MAC and user information from SOLIDserver IPAM to Cisco ISE as devices and users are added, updated, or removed, reducing manual updates and outdated records.

2. Give NetOps and SecOps shared network identity context

Bring Cisco ISE Endpoint and Identity Group context into SOLIDserver to give network teams greater visibility into users, devices, and their security context.

3. Improve policy consistency and traceability

Connect IP addresses, MAC addresses, users, identity groups to provide a clearer view of users and devices and support more consistent policy enforcement.

Keeping Network Access Policies Aligned with Network Reality

Enterprise networks are constantly changing. New devices are added, users change roles, contractors join and leave, and network segments evolve. At the same time, security teams rely on Cisco Identity Services Engine (ISE) to control which users and devices can access the network and under what conditions.

The challenge is that access policies are only as reliable as the data behind them. Incomplete or outdated endpoint, user, or identity information can affect the policy decisions that depend on it. For example, outdated MAC address records create inconsistencies between access controls and the actual state of the network.

This creates a gap between network and security operations. Network teams maintain IP and device information in IPAM, while security teams use ISE to enforce access policies based on identity. When these systems are updated manually, information can become inconsistent, creating additional operational effort and potential security and compliance risks.

The EfficientIP Cisco ISE integration closes this gap through API-based synchronization. SOLIDserver DDI provides authoritative IPAM and user data, while Cisco ISE brings endpoint and identity group context. Together, these synchronized data flows help keep network and security information aligned, supporting consistent, identity-based policy enforcement across the enterprise.

How the EfficientIP Cisco ISE Integration Works

SOLIDserver DDI maintains IP and MAC address information alongside DNS and DHCP data across the network, giving network teams a consistent view of address assignments and devices.

When an IP address with a MAC address is created or updated in SOLIDserver IPAM, the corresponding MAC address is automatically synchronized with Cisco ISE. When the IP address is deleted, the corresponding MAC address is removed from ISE. This keeps the systems aligned as the network changes and reduces the need to maintain the same information separately.

The integration also supports user authentication. When user information is associated with an IP address, the integration can create the corresponding user in Cisco ISE attached to an Identity Group. This allows organizations to use IPAM user information as part of the identity context used by ISE.

In addition, Cisco ISE Endpoint Groups and Identity Groups, which classify devices and users for policy purposes, are regularly stored and updated into a custom database within SOLIDserver. Network teams can therefore access relevant identity context within IPAM without requiring direct access to ISE.

The integration also supports user and device traceability, connecting IP addresses, MAC addresses, and ISE identity groups to provide additional context for troubleshooting, investigations, and compliance activities.

Four Use Cases for Consistent Network Access

1. Automating IP/MAC Address Lifecycle Management

IP and MAC address information changes continuously as devices connect to and leave the network. Keeping these records synchronized manually can become a recurring task, particularly in large and dynamic environments.

With automated synchronization, changes to IP address information in SOLIDserver IPAM are reflected in Cisco ISE, including associated MAC address and Endpoint Group information. Endpoint Group information is also regularly replicated into a SOLIDserver customer database. This keeps IPAM and ISE aligned as device information changes, reduces duplicate data maintenance, and gives NetOps and SecOps teams consistent device information.

2. Supporting User Authentication with Identity Context

Cisco ISE Endpoint Groups and Identity Groups allow organizations to classify devices and users, and apply policies based on those classifications, such as employees, contractors, guests, or IoT devices. Identity Groups provide additional user context for authentication and identity-based access control.

Replicating this identity context into SOLIDserver gives network teams relevant security context alongside their IPAM data. With User Authentication Mode, SOLIDserver synchronizes user information for a specific IP address from IPAM to Cisco ISE instead of MAC address information. This enables Cisco ISE to use user identity information for authentication and identity-based access control, while giving NetOps and SecOps teams a shared view of network and identity information.

3. Improving User and Device Traceability

When troubleshooting an access issue or investigating an incident, an IP address alone may not provide enough context. Teams may need to determine which device was using the address, its MAC address, the associated user, and the relevant Endpoint or Identity Group.

By connecting this information, the integration provides a clearer view of users, devices, and their associations. This can help teams investigate issues more efficiently and better understand device and user associations when troubleshooting or reviewing network changes.

4. Supporting More Consistent Policy Enforcement

Network environments continuously evolve. New devices, network segments, and address assignments can change the context in which access policies are applied.

Keeping IPAM and ISE information synchronized helps reduce the gap between a network change and the corresponding security information. Relevant changes are automatically synchronized through the integration rather than relying on periodic manual updates, helping ISE make access decisions using more consistent endpoint, user, and identity data and supporting Zero Trust principles as the network evolves.

Turning Network Data into NetSecOps Efficiency

The value of the integration extends beyond automating individual updates. It creates a more connected operational model between network and security teams.

For network operations, automation reduces the recurring effort associated with maintaining endpoint and user information between IPAM and ISE and removes manual handoffs that can introduce errors.

For security operations, current MAC and user information from IPAM provides Cisco ISE with relevant data for authentication and access control processes. ISE can work with information that reflects current IP and MAC assignments rather than relying on outdated records.

For operations and compliance teams, the relationship between IP addresses, MAC addresses, endpoint and identity groups, together with the report identifying MAC addresses missing from Cisco ISE, helps teams identify and resolve data gaps. This can support troubleshooting, investigations, and compliance activities. 

The result is a practical NetSecOps workflow:
IPAM data flows into the security policy layer, while endpoint and identity context is brought into network operations.

By connecting these systems, organizations can reduce manual reconciliation, improve network and security data consistency, and respond more effectively as the environment changes. This results in greater operational efficiency, a stronger security posture, and better support for compliance.