| name | implementing-network-access-control-with-cisco-ise |
| description | Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags. Use when deploying enterprise NAC with ISE and Active Directory integration, enforcing endpoint posture compliance, or segmenting access with TrustSec instead of a generic 802.1X/PacketFence setup. |
| domain | cybersecurity |
| subdomain | network-security |
| tags | ["cisco-ise","802.1x","nac","radius","network-access-control","posture-assessment","mab","dynamic-vlan","eap-tls"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"] |
| mitre_attack | ["T1046","T1040","T1557","T1071","T1027"] |
Implementing Network Access Control with Cisco ISE
Overview
Cisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.
When to Use
- When deploying or configuring implementing network access control with cisco ise capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Cisco ISE 3.1+ appliance or virtual machine (16 CPU cores, 64GB RAM minimum for production)
- Cisco switches with 802.1X support (Catalyst 9000 series recommended)
- Active Directory domain with user and computer accounts
- PKI infrastructure for EAP-TLS certificate-based authentication
- DNS and NTP configured consistently across ISE nodes and network devices
- Supplicant software on endpoints (Windows native, AnyConnect NAM, or SecureW2)
Core Concepts
802.1X Architecture
The 802.1X framework involves three components:
| Component | Role | Example |
|---|
| Supplicant | Client requesting network access | Windows 802.1X client, AnyConnect NAM |
| Authenticator | Network device controlling port access | Cisco Catalyst switch |
| Authentication Server | Policy decision engine | Cisco ISE (RADIUS) |
Authentication Flow
1. Endpoint connects to switch port
2. Switch sends EAP-Request/Identity to endpoint
3. Endpoint responds with EAP-Response/Identity
4. Switch forwards credentials to ISE via RADIUS Access-Request
5. ISE authenticates against AD/LDAP/internal store
6. ISE evaluates authorization policy
7. ISE returns RADIUS Access-Accept with attributes (VLAN, dACL, SGT)
8. Switch enforces authorization on the port
Authentication Methods
