Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 1–75

iOS requires an Apple-signed profile, which ISE generates. The device must be able to reach the portal via HTTPS, and the profile must be trusted by the OS.

After successful portal authentication, ISE sends a RADIUS CoA to the NAD. If the NAD is not configured to accept CoA, the session remains in the initial state.

Policy Sets provide a hierarchical and modular structure, allowing for easier management of different authentication/authorization policies.

The Default Privilege setting in the Shell Profile controls the initial privilege level upon successful authentication.

You must create the Command Sets, define the Shell Profiles, and create the Device Administration Policy.

Using a profiling policy to automatically assign endpoints to a group based on matching conditions is the most scalable approach.

The AUP is defined within the Guest Portal's 'Page Customization' settings under the 'Acceptable Use Policy' section.

Device type and operating system are fundamental attributes used in policy conditions to distinguish BYOD devices.

MnT nodes are bandwidth-heavy due to log aggregation; placing them across high-latency, low-bandwidth WAN links can cause replication delays and data loss.

Failures can be due to policy matching, command set configuration, or device-side restrictions.

The AnyConnect agent provides a 'Retry' or 'Re-scan' button in the UI once a non-compliant state is detected.

The 'cisco-av-pair' attribute with the 'ip:inacl#x=...' format is the standard way to push dACLs.

The 'Privilege Level' attribute in the Shell Profile controls the privilege level assigned to the session, which determines if the 'enable' command is necessary or allowed.

Privilege levels are defined within the Shell Profile, which is then mapped to an authorization policy.

Policy Sets in Cisco ISE aggregate authentication and authorization policies for specific traffic types (e.g., Wireless, Wired).

After credentials are verified, the ISE portal triggers the download of the Network Setup Assistant or the SCEP enrollment process.

MDM integration enables automated compliance checks and the ability to wipe or lock devices if they are lost.

After the user authenticates, the client submits a CSR, ISE (via SCEP) signs it, and the certificate is pushed back to the client.

Internal Users and Active Directory are standard identity sources in ISE.

The ISE MDM Server connector periodically polls or receives webhooks from the MDM to update the endpoint status in the ISE database.

The Secondary PAN does not automatically promote itself to Primary. An administrator must manually promote it.

A fresh ISE installation defaults to a standalone node, which includes all personas enabled.

The 'Agent Lifecycle' or 'Client Provisioning' settings allow you to define versioning and update requirements.

Optional means the agent will perform the check, but if the endpoint is non-compliant, the access is not restricted based on that specific requirement.

The AnyConnect profile (xml) can be configured to hide the UI or prevent the service from being stopped by non-admin users.

Network Device Groups (NDGs) allow you to logically group devices and use them in policy conditions.

The Allowed Protocols list contains the certificate settings, and this list is referenced within the Authentication Policy.

CWA requires a specific authorization profile that includes redirection, an authentication rule that bypasses MAB or uses it as a trigger, and the appropriate URL redirect ACLs.

Valid conditions include device location, user group, and NAS-Port-Type.

Command Sets allow specific commands to be permitted or denied, and you can use regular expressions to match command arguments.

Create a Command Set containing 'show .*' (regex) and assign it to an Authorization Policy rule for that user.

You can check the ISE reports or the endpoint's AnyConnect UI.

pxGrid services can be enabled on any PSN, but it is typically recommended to pin them to specific nodes to ensure consistent connectivity for subscribers.

Policy sets can be based on various attributes including device groups and user groups.

If no rules are matched, ISE falls through to the 'Default' rule within the policy set, which usually results in a 'Deny Access' action.

To restrict commands, you define a Command Set with Permit selected and add individual commands like 'show', potentially using regular expressions for granular control.

The 'Command Sets' section within the TACACS+ profile allows you to define permitted or denied commands based on regex or explicit strings.

If multiple command sets are applied, ISE evaluates them. Also, the switch's local privilege level must be aligned with the command set logic.

The Shell Profile defines attributes like privilege level, auto-command, and custom attributes for CLI access.

For RADIUS, the load balancer should use source-IP persistence (sticky sessions) to ensure that the Access-Request and subsequent Access-Challenge/Response messages hit the same PSN.

Verifying the redirect ACL and checking the Authorization Policy for the correct URL redirect attribute are the first steps.

A 'Patch Condition' is used specifically to verify the presence of Windows updates/patches.

The client must trust the Root CA that signed the ISE portal/certificate to ensure the enrollment process is secure.

Guest portals use HTTPS. If the ISE certificate is not signed by a trusted CA, the browser will display a warning.

Policy sets allow for conditions based on Network Device Groups (NDG), which are mapped to devices.

The Feed Service provides updates, allows for manual/automatic updates, and ensures the list of profile policies is current.

MAC Caching allows ISE to remember the device after the first authentication, preventing repeated portal logins. This is enabled under the Guest Portal settings for MAC Caching.

The 'Self-Registration' page settings in the Guest Portal configuration allow enabling fields such as 'Email Address' and configuring the 'Email Validation' mechanism.

TACACS+ utilizes TCP port 49 for communication.

Posture requirements are the components that define the specific checks (e.g., OS version, registry keys) that must be met to reach a compliant state; if not met, the remediation action is triggered.

Network Device Groups (NDGs) allow for the logical organization of network devices, enabling policy application based on device type or location.

Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles.

If the endpoint is not found, the default authorization policy will typically match a 'default' rule that denies access or places the device in a guest flow.

The Certainty Factor is a weight applied to attributes to determine the confidence of a profile match, and it is configured within the profiling policy.

Policy sets are matched based on conditions defined at the top level of the set. Ensure the Guest traffic satisfies the condition (e.g., matching a specific SSID or Device Type).

The workflow involves the guest requesting access, the sponsor receiving an email notification, and the sponsor logging into the portal to approve or deny the request.

The registration requires the secondary node's hostname/IP and administrative credentials to authenticate the handshake process.

ISE allows matching based on a wide range of attributes from dictionaries including Network Device, Endpoint, and Session attributes.

The TACACS+ Livelogs provide the most granular view of the request, policy matching, and the selected results.

Authorization policies link identities to command sets and shell profiles.

The redirect ACL allows DNS and traffic to the ISE portal while blocking all other traffic until the device is provisioned.

Operations > Reports > Endpoints and Users > Posture Assessment is the standard path to view posture-specific reports.

Authorization rules consist of conditions (matching criteria) and results (the profile applied).

Checking the 'Registration Status' in the Endpoints menu confirms if the database correctly marked the device as registered.

The HTTP probe inspects the User-Agent string in HTTP headers, which identifies the browser and OS.

To enable posture assessment, you must upload the AnyConnect Compliance Module, which contains the logic for checking OS and application compliance.

The Authorization Profile containing the 'Redirect' attribute is what forces the client to the portal.

If the AV software is installed but the posture agent does not recognize it, the version or the specific product identifier in the requirement might be slightly off, or the agent is not receiving the latest compliance library updates.

The 'Post-Login' landing page configuration in the Guest Portal allows you to define the URL to which the user is redirected after a successful authentication.

ISE requires tight time synchronization between all nodes in the deployment for certificate validation and log timestamps; large drifts cause replication failure.

The Hotspot portal is specifically designed for 'click-through' access, commonly used in public Wi-Fi environments.

ISE uses 'Device Profiling' (via DHCP fingerprinting, HTTP User-Agent, etc.) to identify the device and trigger the correct provisioning flow.

If the session is not updated, the switch doesn't know the status has changed. A CoA is required to re-evaluate the session after approval.

Using TACACS+ for command authorization is a best practice for enforcing the principle of least privilege.

Reviewing the endpoint attributes in the 'Context Visibility' section will reveal which specific probes or attributes caused the incorrect profile match.