Policy Enforcement · Topic 4 of 7

Monitor, Low Impact, Closed Mode and Host Modes

Learn the three phased modes for wired 802.1X, monitor, low impact and closed, and the four host modes that decide how many devices a port accepts.

5 min

In a nutshell

Monitor mode is open. Everything is allowed, and ISE records what would have happened.
Low impact mode adds a pre authentication ACL, and ISE widens access after authentication.
Closed mode allows only authentication traffic until the device is authorised.

What it is

The access modes decide what a switch port allows before a device has authenticated, and the host modes decide how many devices share a port.

Cisco recommends rolling out 802.1X in phases. You start by watching, you then add light control, and only at the end do you block unauthenticated traffic.

How it works

Each mode is a stage of the rollout with a different default state for the port before authentication.

Monitor mode

In monitor mode the port is open. Every device gets full access, whether it authenticates or not.

The switch still runs 802.1X and MAB, and ISE still logs the result. You use this phase to find devices that would fail, such as printers with no supplicant, before anything is blocked.

On a classic IOS XE configuration this is done with the authentication open command on the port. With no ACL on the port, traffic flows normally.

Low impact mode

Low impact mode adds a small ACL to the port. Before authentication the device can reach only the basics, such as DHCP, DNS and ISE.

When ISE authorizes the device, it can send a downloadable ACL or a named ACL that widens access. The port still has the open setting, so a failed device is not fully blocked. It is limited by the pre authentication ACL.

Switch(config)# ip access-list extended ACL-DEFAULT
Switch(config-ext-nacl)# permit udp any eq bootpc any eq bootps
Switch(config-ext-nacl)# permit udp any any eq domain
Switch(config-ext-nacl)# permit ip any host 10.1.1.11
Switch(config-ext-nacl)# deny ip any any
Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# ip access-group ACL-DEFAULT in
Switch(config-if)# authentication open

This is classic IOS XE syntax. The ACL allows DHCP, DNS and traffic to the PSN at 10.1.1.11, which is a placeholder.

Closed mode

Closed mode is the end state. The port allows nothing except authentication traffic until a device is authorized.

With IBNS 2.0 you set this on the port. Without authentication open on a classic port the default is also closed.

Switch(config-if)# access-session closed

Closed mode gives the strongest control. It also has the biggest risk, because a device that cannot authenticate gets no network at all. Devices that boot over the network, such as those that use a PXE boot, can fail to start.

Comparing the modes

Mode	Before authentication	After authentication	Risk
Monitor	Full access	Full access, or as ISE sets	Lowest
Low impact	Limited by pre auth ACL	Wider access from ISE	Medium
Closed	No access	Access from ISE	Highest

Host modes

A host mode says how many endpoints the port will accept, and how they are authenticated.

Host mode	Behaviour
Single host	One endpoint on the port. A second MAC address is a violation.
Multi host	The first endpoint authenticates, and others are allowed in behind it.
Multi domain	One data device and one voice device, each authenticated.
Multi auth	Many endpoints, and each one authenticates on its own.

Multi auth is a common choice with ISE. It suits a phone with a PC behind it, and a port that feeds a small switch or hub.

Multi host is risky, because once the first endpoint passes, any other device on the port is let through. Multi domain is the original design for a phone and PC, and it expects the phone to be in the voice VLAN.

Switch(config-if)# authentication host-mode multi-auth

On IBNS 2.0 the matching command is access-session host-mode multi-auth.

Choosing a rollout path

Start every site in monitor mode. Review the live logs and the failures. Fix the profiles and the supplicants, then move the ports to low impact or closed mode in stages.

Exam tip

Use monitor mode first, and read the ISE live logs for failures before you restrict a single port.

What to remember for the exam

Seven facts cover this topic.

Monitor mode is open. Everything is allowed, and ISE records what would have happened.
Low impact mode adds a pre authentication ACL, and ISE widens access after authentication.
Closed mode allows only authentication traffic until the device is authorised.
The usual rollout order is monitor, then low impact, then closed.
Single host allows one endpoint, and multi host lets others in behind the first.
Multi domain suits a phone and a PC. Multi auth authenticates every endpoint separately.
authentication open gives open behaviour on a classic port, and access-session closed sets closed mode in IBNS 2.0.

Watch out

Multi host mode lets any device through after the first one authenticates. Use multi auth where you need each device checked.

Common mistakes

These four mistakes are common.

Going straight to closed mode. Devices with no supplicant and PXE boots lose the network.

Using multi host on a shared port. One authenticated device opens the port for everything behind it.

Writing a pre authentication ACL that blocks DHCP. The device never gets an address and cannot reach ISE.

Skipping the monitoring phase. You discover the failing devices only when users complain.

Check yourself

Work through these three questions.

What is the main difference between monitor mode and closed mode?
Monitor mode allows all traffic before and after authentication, and closed mode allows only authentication traffic until the device is authorised.
Which host mode authenticates each endpoint on a port separately?
Multi auth.
What does the pre authentication ACL allow in low impact mode?
Only the basics, such as DHCP, DNS and traffic to ISE.

Topic 4 of 7 in Policy Enforcement

Test yourself on Policy Enforcement

The full Cisco CCNP 300-715 SISE question bank has 852 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.