300-715 SISE: Implementing and Configuring Cisco Identity Services Engine

Cisco ISE split deployments divide the authentication, authorization, and accounting (AAA) workload between the primary and secondary nodes, optimizing the AAA workflow while allowing either node to handle the full AAA workload if connectivity fails.

During the interval before secondary PAN promotion, Cisco ISE continues to support existing or new Active Directory user RADIUS authentication and posture. Hotspot is excluded as a device-registration flow; Guest AUP is unavailable; and BYOD onboarding with the internal CA requires an active primary PAN.

Cisco ISE achieves Policy Service Node redundancy by placing two or more PSNs in a node group. Group members detect peer failures and a surviving member can issue Change of Authorization requests to reset affected URL-redirected sessions, enabling clients to reconnect through an available PSN. Cisco ISE Network Deployments documentation

show authentication sessions displays all current Auth Manager sessions, including sessions authenticated through 802.1X (dot1x) and MAC Authentication Bypass (mab). No interface qualifier is used when all switch-port sessions are required.

The ip http server command enables the HTTP server, which web-based authentication uses to communicate with and redirect clients for authentication. HTTPS requires ip http secure-server; 802.1X and MAB are enabled with separate authentication configuration.