Chapter 2 of 7 · Cisco CCNP 300-715 SISE
Policy Enforcement
Identity stores, 802.1X on wireless and wired, MAB, TrustSec and policy sets.
- 7topics
- 35 minfast track
- 3diagrams and exhibits
- 25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Identity Stores, Active Directory and LDAPJoin ISE to Active Directory, connect an LDAP server, and compare identity store options including certificates, token servers…5 min
- 2Wireless Network Access with 802.1XSet up an 802.1X secured WLAN with ISE, from the controller RADIUS settings and WLAN security to the ISE network device, allowed…Diagram5 min
- 3Wired 802.1X with IBNS 2.0Configure wired 802.1X on a Catalyst switch for ISE, covering global AAA, RADIUS and CoA settings, and the IBNS 2.0 class maps…5 min
- 4Monitor, Low Impact, Closed Mode and Host ModesLearn the three phased modes for wired 802.1X, monitor, low impact and closed, and the four host modes that decide how many…5 min
- 5MAC Authentication BypassLearn how MAC Authentication Bypass authenticates devices with no supplicant, how the switch and ISE use the MAC address, and how…Diagram5 min
- 6Cisco TrustSecUnderstand Cisco TrustSec security group tags, classification, propagation by inline tagging and SXP, and enforcement with SGACLs…Diagram5 min
- 7Policy Sets and Authorization ProfilesBuild ISE policy sets with authentication and authorization rules and conditions, and create authorization profiles that return…5 min
About this chapter
What this chapter covers
Policy enforcement is the core of ISE: it decides who or what is allowed onto the network, and with what access.
The chapter starts with the identity stores that ISE asks. It then covers the access methods, which are 802.1X on wireless, 802.1X on wired ports, and MAC Authentication Bypass. It finishes with TrustSec and the policy sets that tie everything together.
Most of the later chapters reuse the pieces from here. Guest access, profiling, BYOD and posture all end in an authorization result that you build with the tools on these pages.
How the topics fit together
Every request follows the same path, from the endpoint, through the network device, to a policy decision on ISE.
The topics line up with that path:
- Identity stores are where ISE checks the user or machine.
- Wireless and wired 802.1X are the methods used by devices that can run a supplicant.
- Monitor, low impact and closed modes are the phases for rolling 802.1X out on wired ports.
- MAB covers devices that cannot run a supplicant.
- TrustSec turns the result into a role based tag that controls traffic inside the network.
- Policy sets and authorization profiles are where you write the decisions.
The same live log in Operations, RADIUS shows every one of these steps, so it is the main tool for checking your work.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
The examples use IOS XE for switches and the Catalyst 9800 for wireless. Read the identity store page first, because the later pages assume that a store exists. Read the policy page last, because it uses the results of all the others.
Ready for more practice?
The full Cisco CCNP 300-715 SISE question bank has 852 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.