300-715 SISE: Implementing and Configuring Cisco Identity Services EngineDemo

During the interval before secondary PAN promotion, Cisco ISE continues to support existing or new Active Directory user RADIUS authentication and posture. Hotspot is excluded as a device-registration flow; Guest AUP is unavailable; and BYOD onboarding with the internal CA requires an active primary PAN.

Cisco ISE achieves Policy Service Node redundancy by placing two or more PSNs in a node group. Group members detect peer failures and a surviving member can issue Change of Authorization requests to reset affected URL-redirected sessions, enabling clients to reconnect through an available PSN. Cisco ISE Network Deployments documentation

show authentication sessions displays all current Auth Manager sessions, including sessions authenticated through 802.1X (dot1x) and MAC Authentication Bypass (mab). No interface qualifier is used when all switch-port sessions are required.

The ip http server command enables the HTTP server, which web-based authentication uses to communicate with and redirect clients for authentication. HTTPS requires ip http secure-server; 802.1X and MAB are enabled with separate authentication configuration.

The online Cisco ISE Feed Service downloads updated profiling-feed information from Cisco’s external feed service, so Cisco ISE requires Internet access to obtain feed updates. Cisco’s current ISE installation guidance lists the Profiling feed service as requiring access to https://ise.cisco.com over HTTPS (TCP 443).

An internal Cisco ISE user whose password authentication is configured for an external identity store must select that external store at Admin portal sign-in. Selecting the Internal identity source attempts authentication against the internal store instead, and authentication fails.

Cisco ISE allows sponsors to create multiple guest accounts by importing guest details from a file or by generating multiple random accounts for guests not yet identified. Known guest accounts are created individually; Daily and Monthly describe duration or time settings, not bulk-creation methods.

Active Directory stores password-derived hashes rather than clear-text user passwords. Password authentication derives a hash from the password presented by the user and validates it by matching that hash to the corresponding hash stored in Active Directory.

Wireless guest access with a captive portal requires a web authentication (WEBAUTH) ACL to redirect unauthenticated client traffic to the portal while allowing the necessary preauthentication services.

For TACACS+ device administration, the device sends the login request to Cisco ISE, and Cisco ISE validates the administrator’s details by querying the configured identity store. The identity store may be either internal to Cisco ISE or external.

Cisco ISE supplies downloadable ACL authorization data through Cisco vendor-specific RADIUS attributes during the authentication/authorization exchange, so radius-server vsa send authentication is required. dot1x system-auth-control globally enables 802.1X, allowing the configured aaa authentication dot1x and aaa authorization network methods to operate for the switch ports.

In a two-node Cisco ISE primary-secondary deployment, deregistering the secondary node causes both nodes in the primary-secondary pair to restart. The deregistered secondary node subsequently becomes standalone.

A default network AAA accounting method list with start-stop group radius enables the switch to generate and send RADIUS Accounting-Start and Accounting-Stop records for network-related service requests to the RADIUS server group. Cisco documents aaa accounting network ... start-stop ... radius as the command that enables RADIUS accounting for network-related requests.

Cisco ISE’s Sponsor Portal enables sponsor-group members to create guest accounts and manage their lifecycle, such as editing, suspending, extending, deleting, and reinstating accounts, subject to assigned permissions. Authorization configuration and Cisco ISE authentication are administrative functions outside the sponsor role.

Central Web Authentication relies on a MAB rule that continues when the endpoint MAC address is not found. This lets Cisco ISE proceed to authorization policy evaluation, where it can apply the Central Web Authentication redirect rather than rejecting the unknown endpoint.

Cisco ISE network probes are provided by the Profiling service, which in a distributed deployment runs on nodes that assume the Policy Service persona. Cisco documentation specifies that probes are configured per Policy Service node.

Cisco ISE can report an endpoint posture status as Compliant or Unknown. The documented posture-status values include Compliant and Unknown; “valid,” “known,” and “invalid” are not defined compliance statuses.

Both operations require permission to search Active Directory to verify whether a Cisco ISE machine account already exists. Creating the account and setting its attributes apply to joining, while removing the account applies to leaving.

show authentication sessions mac 000e.84af.59af details selects the active Auth Manager session by its MAC address and displays its detailed session fields, including authorization, VLAN policy, handle, and the state of the dot1x authentication method. Cisco documents the mac mac-address session selector and the optional details keyword for this command.

Cisco ISE creates default endpoint identity groups for blocked endpoints, profiled endpoints, and endpoints that do not match a profiling policy: Block List, Profiled, and Unknown.

A Cisco ISE posture requirement evaluates one or more posture conditions and associates a remediation action to run or present when that requirement fails. Client provisioning, updates, and access policies are related configuration areas, but they are not the defining components of a posture requirement.

The RADIUS Idle-Timeout attribute (attribute 28) sets the maximum consecutive idle period allowed before an authenticated MAB session is terminated. Cisco documents that the MAB inactivity timer can be dynamically assigned with this attribute.

An authorization profile contains the Assess Vulnerabilities option used to trigger endpoint vulnerability scans and configure their interval. An authorization policy can apply that profile, but the scan configuration resides in the authorization profile.

Cisco ISE issues a Change of Authorization when an endpoint profiling policy changes and that policy is used by an authorization policy, allowing the endpoint’s access to be reevaluated under the updated policy.