Network Access Control and Cisco ISE

Network Access Control, or NAC, is a set of policies and technologies that control which devices can connect to a network. Think of a network as a building with many rooms. Before NAC, if you could plug a cable into the wall or connect to the Wi-Fi, you were in — you had access to everything. That was a huge security problem. A visitor could bring a virus-infected laptop into the office, plug it in, and infect the entire company. NAC solves this by checking every device before it gets access.

Cisco ISE (Identity Services Engine) is a specific product from Cisco that does NAC. It is a server — a powerful computer — that sits in the network and acts as the brain behind the decision-making. ISE is not the only NAC product, but it is the one you will see on the 350-701 exam.

How does ISE work? It uses a process often called AAA, which stands for Authentication, Authorisation, and Accounting. Let us break those down.

Authentication is the process of verifying identity. Is this device who it claims to be? The device might prove its identity using a username and password, a digital certificate (a kind of electronic ID card), or by being plugged into a specific switch port. If authentication fails, the device is denied entry to the network. It is like showing your passport at airport security.

Authorisation happens after authentication. Even if the device is allowed to connect, what is it allowed to do? ISE applies a policy. For example, a manager's laptop might get full access to all files. A guest's phone might only get internet access. An infected device might be put into a quarantine network where it can only reach the antivirus update server. ISE does this by assigning the device to a specific VLAN (Virtual Local Area Network — a way of splitting a physical network into smaller, separate segments) or by applying an ACL (Access Control List — a set of rules that allow or block traffic).

Accounting is the logging part. ISE keeps records of every device that tried to connect, when, and what it did. This is useful for security investigations. If a hacker breaks in, the logs will show exactly which device connected from which port.

Now, how does ISE actually talk to the switches and access points on the network? It uses a protocol called RADIUS (Remote Authentication Dial-In User Service). When a device plugs into a switch, the switch sends a RADIUS message to ISE asking, "What should I do with this device?" ISE responds with the decision — allow, deny, or quarantine.

NAC replaces the old model of "trust the network port." In the past, if a wall jack was active, you got full access. With NAC, every single connection request is evaluated in real time. This is especially important with the rise of BYOD (Bring Your Own Device — employees using personal phones and laptops for work). You cannot trust a personal device the same way you trust a company-issued laptop.

Cisco ISE also supports 802.1X, which is a standard for port-based authentication. When a device connects to an Ethernet port or a Wi-Fi network, 802.1X forces the device to authenticate before it gets an IP address (Internet Protocol address — the unique number that identifies a device on a network). If the device does not have the right credentials, it never even gets an IP address, so it cannot communicate with anything.

Another key feature is profiling. ISE can look at the characteristics of a device — its operating system, its MAC address (Media Access Control — a unique hardware identifier burned into every network card), and how it behaves — to guess what kind of device it is. This is called profiling. For example, a device that sends Apple-specific traffic is probably an iPhone. ISE can then automatically apply the right policy without a human having to tell it.

Finally, ISE integrates with other security tools. It can talk to a malware detection system. If that system reports that a laptop has a virus, ISE can change that laptop's access level in real time, moving it to a quarantine VLAN. This is called a change of authorisation or CoA.

For the 350-701 exam, you need to know the basic NAC flow: device connects, switch sends RADIUS request to ISE, ISE authenticates and authorises, switch enforces the policy, ISE logs everything. You also need to know the components: ISE, RADIUS, 802.1X, VLANs, ACLs, and the AAA framework.

An IT professional, let us call her Priya, works for a medium-sized company with 500 employees. The company allows employees to bring their own phones and laptops (BYOD). She is responsible for network security. Before she set up NAC, anyone who guessed the Wi-Fi password could access internal file servers. One day, an employee's personal laptop was infected with ransomware. When that employee connected to the office Wi-Fi, the ransomware spread to the company's file server, encrypting important documents. The company had to pay a ransom. Priya's boss told her to fix the network so that never happened again.

Priya decided to deploy Cisco ISE. Here is what she did step by step:

First, she installed the ISE server in the company's data centre. She configured it with the list of company-owned devices by importing their MAC addresses from the company's asset database. She also set up integration with Microsoft Entra ID so that employee credentials could be used for authentication.

Next, she configured the network switches and Wi-Fi controllers to talk to ISE. On each switch, she enabled 802.1X and pointed the switch to the ISE server using RADIUS. She also configured a guest VLAN and a quarantine VLAN on the switches.

Then, she created policies in ISE. She created a policy that said: if a device is a company-issued laptop and has a valid certificate, give it full access (VLAN 10). If a device is a personal smartphone and the user authenticates with their work credentials, give it internet-only access (VLAN 20) and block it from internal servers. If a device is unknown, put it in a quarantine VLAN (VLAN 99) where it can only reach the ISE server itself to register.

Now, when an employee tries to connect their personal phone, the phone prompts for a username and password. The switch sends a RADIUS request to ISE. ISE checks the credential against Microsoft Entra ID. If the credential is valid, ISE tells the switch to put the phone on VLAN 20. The phone gets an IP address in that VLAN and can browse the internet but cannot access the company's internal file server.

If a visitor comes in and plugs a laptop into an Ethernet port, the switch sends a RADIUS request. ISE does not recognise the laptop. Instead of denying it completely (which would frustrate the visitor), ISE tells the switch to put it on the quarantine VLAN. The visitor then opens a web browser and is redirected to a captive portal — a webpage that asks for a guest passcode. If they enter the correct code, ISE updates the policy and moves them to the guest VLAN.

Priya also set up automated actions. If the company's antivirus system detects an infection on a laptop, it sends an alert to ISE. ISE immediately changes that laptop's authorisation, moving it to the quarantine VLAN. The laptop can no longer reach the file server, and the infection is contained.

Every day, Priya checks the ISE dashboard for reports. She looks for failed authentication attempts, which might indicate someone trying to break in. She also reviews the list of profiled devices to ensure the system is categorising them correctly.

For the 350-701 exam, you should understand this workflow. You will not be asked to configure ISE in detail, but you will be expected to know what the steps are and why the company needs them. Questions often describe a scenario like the one above and ask which policy or VLAN the device should be placed in.