Working with pxGrid 2.

0 APIs

Viktor Bobrov
Sr. Technical Leader
@securityccie

DEVNET-2038
 Cisco Webex App

Questions?
Use Cisco Webex App to chat
with the speaker after the session

How
1 Find this session in the Cisco Live Mobile App

2 Click “Join the Discussion”

3 Install the Webex App or go directly to the Webex space

4 Enter messages/questions in the Webex space

Enter your personal notes here

Webex spaces will be moderated by the speaker until June 13, 2025.

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 2

-
 Agenda 01 Intro to pxGrid
02 pxGrid Architecture
03 pxGrid APIs
04 Authentication
05 REST API
06 Websockets
[Link]
07 pxGrid Direct
08 CLI Client

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 3

-
Intro to pxGrid
 Context: Build, Summarize, Exchange Use Case #1
Visibility and Access Control Context Reuse
ISE builds context and applies access control
by eco-system partners for analysis & control
restrictions to users and devices

Threat Intelligence Mobility Services Engine

System managers Mobile Device Managers Who

Directory Services Vulnerability Scanners What

When Secure Network Analytics
pxGrid
How
REST API Secure Firewall
Where
Syslog
ISE Posture
Catalyst Center

Threat + Security Partners

Vulnerability

Security Group
Endpoints Tag (SGT)

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 5

-
 Adaptive Network Control (ANC) Use Case #2

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 6

-
 pxGrid IOT Profiling Use Case #3
pxGrid Context-In (Cyber Vision, Culinda, Cylera, Ordr, Asimily, Armis, Nozomi, Radiflow)

ISE
IOT ISE Authz
Asset pxGrid Policy
Solution
Publisher Subscriber
Endpoint
Asset Topic

Profiling ISE Authorization Policy:

Standardized Attributes:
assetID, assetName, assetIpAddress, Policy: Classifies & Enforce
assetMacAddress, assetVendor, IOT Asset Dictionary Policy
assetProductId, assetSerialNumber,
assetDeviceType, assetSwRevision, Customized Dictionary
assetHwRevision, assetProtocol
Customized Attributes:
Threat level Information

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 7

-
 pxGrid CMDB Sync Use Case #4
3.2

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 8

-
 ISE & pxGrid Growing Partner Ecosystem
Benefits

IAM & SSO Application

Simplify operations
Vulnerability
SIEM
UEBA Assessment
Threat Defense ?
Enhance Controls

Net/App Packet Capture

Performance & Forensics
Improve Response
Cisco ISE & pxGrid
Rapid Threat
IoT

100+
Containment
Security (RTC)

Firewall &
Partner integrations Cloud Access
Access Control & Growing Security

DDI

EMM/ SOAR /
MDM Other

Firepower Deception
StealthWatch, WSA, AMP,
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038
CTA, IND 9 9

-
Architecture
 ISE Deployments and pxGrid Nodes
<=50: PSNs + <= 4 PXGs)
PAN MNT PSN pxGrid

All pxGrid Nodes are Active

Small HA Deployment Medium Multi-node Deployment Large Deployment

2 x (PAN+MNT+PSN) 2 x (PAN+MNT+PXG), <= 6 PSN 2 PAN, 2 MNT, <=50: PSNs + <= 4 PXGs

Small Medium Large

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 11

-
 pxGrid 2.0 Components
External

HTTP HTTP
STOMP over STOMP over
WebSocket WebSocket
Port 8910 Port 8910
pxGrid pxGrid pxGrid
Publisher Controller Subscriber
Listens on TCP ports:
7400: Connection for internal processes (internal only)
8910: service check (all nodes), pub-sub (pxGrid node)
pxGrid 2.0 nodes always active (not shown in CLI)

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 12

-
 pxGrid HA Active/Active

pxGrid Node 1 pxGrid Node 2

Dedup
pxGrid Client

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 13

-
 pxGrid HA Active/Passive

pxGrid Node 1 pxGrid Node 2

Bulk Download from MnT

pxGrid Client

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 14

-
pxGrid APIs
 Hidden Python Code Slides

The code on the slides is bare minimum.

Full examples are available at
[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 19

-
 Also with Curl

curl [Link] \
--cacert <ca-file> \
--cert <client-cert-file> \
--key <client-key-file> \
-d ‘<postdata>’ \
-H 'Content-Type: application/json'

r=[Link](f"[Link]
verify=”<ca-file>",
cert=(”<client-cert-file>",”<client-key-file>"),
auth=(”<username>",”<password>"),
json={<postdata>}
)

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 20

-
 pxGrid 2.0 Components
[Link]
pxGrid 2.0
Services

SessionDirectory
Endpoint
RadiusFailure
Profiler Configuration
System Health
MDM
ANC Status
TrustSec
TrustSec Configuration
TrustSec SXP
Endpoint Asset

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 21

-
 REST API Calls

• TCP/8910
• Atomic operations
• Used to retrieve and post data
• All requests are POST even when no data is posted.
• pxGrid allows clients to discover where to request data from
• Data received directly from publishing nodes. Eg. Adm and MnT

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 22

-
 Pub/Sub

• Also TCP/8910, upgraded to a websocket

• STOMP used over the websocket
• Publishers send data to topics
• Subscribers subscribe to topics and receive data
• pxGrid allows clients to discover where subscribers can connect to a topic
• All websocket connections are to pxGrid nodes

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 23

-
 ISE Topology for this Session

vb-cl-ise-adm1 vb-cl-ise-adm2 vb-cl-ise-psn1 vb-cl-ise-psn2

vb-cl-ise-mnt1 vb-cl-ise-mnt2 vb-cl-ise-px1 vb-cl-ise-px2

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 24

-
Authentication
 Certificates – ISE Certificates

• Admin and MnT nodes need pxGrid certificate. Not just pxGrid nodes
• Recommended to have certificates from Corporate CA
• Certificates must have Client and Server Authentication EKUs

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 26

-
 Certificates – Client Certificates

• Client Certificates not needed if using password authentication

• FQDN of client certificate is not validated by ISE
• You can even use ISE pxGrid certificate on the client
• Client and ISE certificates do not need to be from the same CA chain
• Client certificate also must have Client and Server EKUs

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 27

-
 Certificates - Trust

ISE must trust client roots. N/A when using password authentication
$ curl [Link] --cacert [Link]

$ curl –k [Link]

Client “should” trust ISE root

Ignoring trust works too

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 28

-
 Client Approval
All clients must be approved before being able to use pxGrid

Clients can be
auto-approved
Still requires client
certs

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 29

-
 Authentication Flow - Certificate

AccountActivate Client REST API

Approve ISE Admin

* Once account is approved, steps can be skipped. They verify that account is still ENABLED

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 30

-
 Authentication Flow - Password

AccountCreate Client REST API

AccountActivate Client REST API

Approve ISE Admin

* Once account is approved, steps can be skipped. They verify that account is still ENABLED
** ISE generates the password for the account. Password must be stored on the client

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 34

-
 Authentication Demo

• 01_auth_cert.py – Authenticate with certificates

• 02_auth_pwd.py – Authenticate with password

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 39

-
REST API
 API Reference Example

[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 41

-
 Endpoint 3.4

• Real-time publishing of endpoint data

• Exposes all endpoint attributes from Context
Visibility

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 42

-
 REST API Flow - Certificate-Based

ServiceLookup For name from wiki: eg. [Link]

Execute API Using Client Certificate

* Assuming client account is approved

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 43

-
 REST API Flow - Password-Based

ServiceLookup For name from wiki: [Link]

AccessSecret Access Secret is generated by ISE and will be

different for each node.
Different than client password
Execute API Authenticate with Secret.

* Assuming client account is approved

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 44

-
 Check Schema JSON List []

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 53

-
 Request Filtering 3.4

• Available in for SXP, Session Directory

• Both REST API and Websockets
• JMESPath
• Reference: [Link]
rest-ws/wiki/pxGrid-Filtering

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 58

-
 REST API Demo

• 11_rest_secgroups_cert.py – Security Groups with Certificate Authentication

• 12_rest_secgroups_pwd.py – Security Groups with Password Authentication
• 13_rest_sessions_cert.py - Sessions
• 14_rest_sessions_filter_cert.py – Sessions with filter
• 15_rest_endpoints.py - Endpoints
• 16_rest_ancpolicy_cert.py – ANC Policy Creation
• 17_rest_applypolicy_cert.py – Applying ANC Policy

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 59

-
Websockets
 What are Websockets

A WebSocket is a persistent bi-directional

communication channel between a client (e.g. a
browser) and a backend service. In contrast with HTTP
request/response connections, websockets can
transport any number of protocols and provide server-
to-client message delivery without polling.

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 61

-
 STOMP

[Link]

Frames are null (0x00) terminated

00000000 53 55 42 53 43 52 49 42 45 0a 64 65 73 74 69 6e |[Link]|
00000010 61 74 69 6f 6e 3a 2f 74 6f 70 69 63 2f 63 6f 6d |ation:/topic/com|
00000020 2e 63 69 73 63 6f 2e 69 73 65 2e 73 65 73 73 69 |.[Link]|
00000030 6f 6e 0a 69 64 3a 63 6c 69 0a 0a 00 |[Link]:cli...|
0000003c

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 62

-
 STOMP and pxGrid
[Link]

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 63

-
 Posture Visibility 3.4

• Application Inventory
• Running Processes
• Hardware Inventory
• Does not include posture checks

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 65

-
 Endpoint 3.4

• Real-time publishing of endpoint data

• Exposes all endpoint attributes from Context
Visibility

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 66

-
 Websocket Flow - Subscribe

ServiceLookup - Topics

ServiceLookup - PubSub Certificate Required if Using Certificates

AccessSecret

Establish WS Conn Basic Auth with Secret OR certificates

STOMP Connect

STOMP Subscribe
* Assuming client account is approved
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 67

-
 STOMP Subscribe Flow
CONNECT
accept-version:1.2 Client -> Server
host: {node_name} From PubSub Lookup. Eg: ~ise-pubsub-vb-cl-ise-px1
\x00
CONNECTED
Client <- Server
heart-beat:0,0
version:1.2

SUBSCRIBE
destination:{topic} From Service Lookup. Eg: /topic/[Link] Client -> Server
id: {client_id}
Client Identifier. Can be any string. Will be in server
\x00 messages
MESSAGE
content-length:680
destination:/topic/[Link] Client <- Server
message-id:19544
subscription:{client_id}

{"sessions”:....... }
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 68

-
 Websocket Flow – Context-In (IOT Profiling)

ServiceRegister

ServiceLookup - PubSub Certificate Required if Using Certificates

AccessSecret Same API Calls as previous example

Establish WS Conn Basic Auth with Secret OR certificates

STOMP Connect

STOMP Send
* Assuming client account is approved
Data picked up by pxGrid Probe
© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 77

-
 STOMP Context-In Flow
CONNECT
accept-version:1.2 Client -> Server
host: {node_name} From PubSub Lookup. Eg: ~ise-pubsub-vb-cl-ise-px1
\x00
CONNECTED
Client <- Server
heart-beat:0,0
version:1.2

SEND
destination:/topic/[Link]
content-length:373 Client -> Server

{"opType": "CREATE","asset": {"assetId":

1,"assetName": "IOT1”..SNIP…

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 78

-
 Asset JSON
Documented at [Link]
{
"opType": "CREATE",
"asset": {
"assetId": 1,
"assetName": "IOT1",
"assetIpAddress": "[Link]",
"assetMacAddress": "22:33:44:55:66:77",
"assetVendor": "CL",
"assetHwRevision": "1.0",
"assetSwRevision": "2.0",
"assetProtocol": "Telnet",
"assetProductId": "Wifi-IOT",
"assetSerialNumber": "ABC12345",
"assetDeviceType": "WiFi",
"assetConnectedLinks": [
{
"key": "wifi1",
"value": "ssid1"
}
]
}
}

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 79

-
 Websocket API Demo

• 21_ws_session_pwd.py – Sessions
• 22_ws_session_cert_filter.py – Sessions with filtering
• 23_ws_endpoint_cert.py – Endpoints
• 24_ws_context_in_cert.py – Context-In
• 25_ws_posture_cert.py – Posture Visibility

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 88

-
pxGrid Direct
 Introduction

• Generic Integration with external CMDB

• HTTP Service
• Basic Authentication (Oauth coming)
• Receives JSON Structure
• ISE Initiates the connections
• Data is stored separate from endpoints

Not exactly pxGrid

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 90

-
 pxGrid Direct Pusher 3.4

• Client initiates (pushes) data to ISE

• Authentication with Admin Accounts
• RBAC Available

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 95

-
 pxGrid Direct Demo

• 31_pxdirect_server.py – pxGrid Direct Fetch

• 32_pxdirect_pusher.py – pxGrid Direct Push

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 99

-
CLI Utility
 Interactive pxGrid CLI client

[Link]
• Support for both certificate and password authentication
• Commands and methods to interact with most pxGrid services
• Websocket support for subscribing to topics and Context-in.
• Debug capabilities to show all low-level interactions with pxGrid

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 101

-
 Installation

# Install module
$ pip install pxgrid-api

# Run utility
# pxshell
pxshell>

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 102

-
 Built-in Help
pxshell> help

Documented commands (type help <topic>):

========================================
accountcreate anc debug mdm radius sxp trustsec
activate config help profiler session system trustseccfg

Undocumented commands:
======================
EOF
pxshell> help sxp
sxp options:
bindings: List all SXP bindings
topics: List topics available for subscription
subscribe <topic>: Subscribe to a topic

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 103

-
 Config and Activate
pxshell> help config
Config options:
save <file>: Save config to file
load <file>: Load config from file
apply [file]: Instatiate connection to pxGrid. Optionaly load the file and apply in
one step
show: Show current settings
pxnode <hostname>: Set pxGrid PSN FQDN
name <clientname>: Set pxGrid client name
cert <certfile>: Set client certificate file name
key <keyfile>: Set client private key
root [<rootfile>]: Set root CA file. Leave out <rootfile> to disable server
certificate verification
password <password>: Set password for password based authentication

pxshell> config pxnode [Link]

pxshell> config name pxgrid-client
pxshell> config cert .[Link]
pxshell> config key .[Link]
pxshell> config root .[Link]
pxshell> config apply
pxshell> activate
{
"accountState": "ENABLED",
"version": "2.0"
}

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 104

-
 REST API Calls
pxshell> system perfs
pxshell> session all {
{ "performances": [
"sessions": [ {
{ "timestamp": "2022-11-11T16:49:14.572391-05:00",
"timestamp": "2022-11-10T14:06:24.222-05:00", "serverName": "vb-cl-ise-mnt2",
"state": "AUTHENTICATED", "radiusRate": 0.0,
"userName": "jsmith", "radiusCount": 0,
"auditSessionId": "ac1f1c1000005000636d4bb0", "radiusLatency": 0.0
"ipAddresses": [ },
"[Link]" {
], "timestamp": "2022-11-11T16:49:14.572391-05:00",
----- SNIP ---- "serverName": "vb-cl-ise-mnt1",
pxshell> anc create Stop QUARANTINE "radiusRate": 0.0,
{ "radiusCount": 0,
"name": "Stop", "radiusLatency": 0.0
"actions": [ },
"QUARANTINE"
] --- SNIP ---
}

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 105

-
 Subscribing to Topics

pxshell> session topics

"sessionTopic"
"groupTopic”
pxshell> session subscribe sessionTopic
Ctrl-C to disconnect...
Received Packet: command=CONNECTED content:
{}
Received Packet: command=MESSAGE content:
{
"sessions": [
{
"timestamp": "2022-11-11T16:56:22.561-05:00",
"state": "AUTHENTICATED",
"userName": "jsmith",
"callingStationId": "1C:F3:7D:B7:F5:A0",
--- SNIP ----
}
],
"sequence": 18
}

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 106

-
References
 References

• Code for examples: [Link]

• pxGrid Reference: [Link]
• Developer resources: [Link]
• CLI Utility: [Link]
• “pip install pxgrid-api"
• CLI Utility: [Link]
• “pip install pxgrid-util”

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 108

-
 Complete your session evaluations

Complete a minimum of Earn 100 points per Level up and earn Complete your surveys
4 session surveys and survey completed exclusive prizes! in the Cisco Live
the Overall Event and compete on the mobile app.
Survey to be entered in Cisco Live Challenge
a drawing to win 1 of 5 leaderboard.
full conference passes
to Cisco Live 2026.

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 109

-
 Continue your education

Visit the Cisco Book your one-on-one Attend the interactive Visit the On-Demand
Showcase for related Meet the Engineer education with DevNet, Library for more
demos. meeting. Capture the Flag, and sessions at
Walk-in Labs. [Link]/
on-demand

Contact me at: vibobrov@[Link] (Email/Webex)

© 2025 Cisco and/or its affiliates. All rights reserved. DEVNET-2038 110

-
Thank you