Deploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network access control. Use when deploying cisco identity services engine for 802.1x wired and wireless.
Deploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network access control. Use when deploying cisco identity services engine for 802.1x wired and wireless.
Implementing Network Access Control with Cisco ISE
Overview
Cisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.
When to Use
Trigger phrases:
"implementing network access control with cisco ise"
"Deploy Cisco Identity Services Engine for 802"
When deploying or configuring implementing network access control with cisco ise capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Cisco ISE 3.1+ appliance or virtual machine (16 CPU cores, 64GB RAM minimum for production)
Cisco switches with 802.1X support (Catalyst 9000 series recommended)
Active Directory domain with user and computer accounts
PKI infrastructure for EAP-TLS certificate-based authentication
DNS and NTP configured consistently across ISE nodes and network devices
Supplicant software on endpoints (Windows native, AnyConnect NAM, or SecureW2)
Core Concepts
This section covers core concepts for implementing network access control with cisco ise.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
802.1X Architecture
The 802.1X framework involves three components:
Component
Role
Example
Supplicant
Client requesting network access
Windows 802.1X client, AnyConnect NAM
Authenticator
Network device controlling port access
Cisco Catalyst switch
Authentication Server
Policy decision engine
Cisco ISE (RADIUS)
Authentication Flow
1. Endpoint connects to switch port
2. Switch sends EAP-Request/Identity to endpoint
3. Endpoint responds with EAP-Response/Identity
4. Switch forwards credentials to ISE via RADIUS Access-Request
5. ISE authenticates against AD/LDAP/internal store
6. ISE evaluates authorization policy
7. ISE returns RADIUS Access-Accept with attributes (VLAN, dACL, SGT)
8. Switch enforces authorization on the port
Authentication Methods
Method
Use Case
Security Level
EAP-TLS
Certificate-based, highest security
High
PEAP-MSCHAPv2
Username/password via AD
Medium
EAP-FAST
Cisco proprietary, fast reauthentication
Medium
MAB
Non-802.1X devices (printers, IP phones)
Low
Workflow
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
Step 1: Configure ISE for Active Directory Integration
Navigate to Administration > Identity Management > External Identity Sources > Active Directory:
Add AD join point with domain name (e.g., corp.example.com)
Provide domain admin credentials for ISE machine account
Join ISE to the domain
Select AD groups for authorization policies:
Domain Users - Standard employee access
Domain Computers - Machine authentication
IT-Admins - Privileged access
BYOD-Users - Personal device access
Step 2: Configure Network Devices in ISE
Navigate to Administration > Network Resources > Network Devices:
Name: SW-ACCESS-01
IP Address: 10.0.1.1/32
RADIUS Shared Secret: C0mpl3x$3cretKey!
SNMP Settings: v2c, community string
Device Type: Cisco Switches
Location: Building-A-Floor-1
- Windows Firewall Enabled (Registry check)
- Antivirus Running and Updated (AV compound condition)
- OS Patch Level Current (Windows Update check)
- Disk Encryption Enabled (BitLocker check)
Posture Requirements:
Requirement: Corporate-Windows-Compliance
OS: Windows All
Conditions: Windows Firewall AND Antivirus AND OS Patches
Remediation: Auto-remediate with AnyConnect ISE Posture Module
Posture Policy:
Rule: Windows-Endpoints
Identity Group: Any
OS: Windows All
Requirement: Corporate-Windows-Compliance
Step 7: Configure TrustSec Segmentation
Enable SGT-based segmentation:
! On switch - enable CTS
cts credentials id SW-ACCESS-01 password CtsP@ss
cts role-based enforcement
cts role-based sgt-map 10.0.100.0/24 sgt 5
! Download SGT policy from ISE
cts role-based permissions
ISE TrustSec Matrix (SGACL):
Source SGT
Destination SGT
Policy
Employees (5)
Servers (10)
Permit_HTTP_HTTPS
Employees (5)
PCI_Zone (15)
Deny_All
IT-Admins (3)
Servers (10)
Permit_All
Guest (7)
Internet (99)
Permit_HTTP_HTTPS
Guest (7)
Servers (10)
Deny_All
Troubleshooting
# On switch - verify authentication status
show authentication sessions
show authentication sessions interface Gi1/0/1 details
show dot1x all
# Check RADIUS connectivitytest aaa server radius ISE-PRIMARY username testuser password testpass
# On ISE - check live logs# Navigate to Operations > RADIUS > Live Logs# Filter by MAC address or username# Review Authentication Details for failure reason# Common failure reasons:# 12514 - EAP-TLS handshake failed (certificate issue)# 22056 - Subject not found in identity store# 24408 - User not found in Active Directory# 24454 - User password expired
Best Practices
Monitor Mode First - Deploy in monitor mode (open authentication) before closed mode enforcement
Low-Impact Mode - Use authentication open with pre-auth dACLs for gradual rollout
MAB Database - Pre-populate endpoint database with known MAC addresses for printers, phones
Profiling - Enable ISE profiling to automatically classify endpoints by type
CoA Support - Ensure Change of Authorization is configured for dynamic policy updates
High Availability - Deploy ISE in a Primary/Secondary node pair with PAN failover
Certificate Infrastructure - Use machine certificates for EAP-TLS for strongest authentication
When NOT to Use
You need to test the implementation (use performing-* skills)
Task is about configuring existing tools (use configuring-* skills)
You need to analyze security events (use analyzing-* skills)
Task is about building detection rules (use building-* skills)
