Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 226–300

Checking the endpoint's attributes in Context Visibility reveals exactly what the Profiler has learned. If the DHCP attributes are visible but the policy isn't matching, the policy logic is likely flawed.

Endpoint objects contain the MAC address and a collection of custom and system attributes related to the device.

dACLs are applied per-session and represent a list of ACEs pushed via RADIUS VSA 11.

Command sets use regex or explicit matches. A specific match with 'permit' on other commands and 'deny' on 'show running-config' is the correct approach.

Registry checks are configured under Policy > Policy Elements > Conditions > Posture > Registry Condition.

The 'My Devices' portal allows users to manage, block, or delete their registered BYOD devices.

Change of Authorization (CoA) is the mechanism used by RADIUS to update an active session.

TrustSec simplifies policy management by using group tags instead of IP-based ACLs and decouples security from the network topology.

A custom condition requires selecting the specific DHCP attribute (e.g., Option 60) and defining the value to match.

The 'Posture Assessment' report under Operations provides the 'Result' details, including what the agent detected versus the expected value.

If the Redirect ACL is not properly configured to exclude the ISE PSN IP, the traffic to the ISE portal might get redirected again, causing a loop.

After explicitly denying the specific subnet, you must permit the rest of the traffic with 'permit ip any any'.

The Primary MnT is the active log aggregator, and the Secondary MnT acts as a standby, taking over only if the Primary fails.

The 'ise-psc.log' (Policy Service Component) is the primary log for posture policy evaluation and agent communication.

Deployment involves creating the Client Provisioning resource and then creating the policy to assign it to endpoints.

Devices can be identified via manual registration by the user or through automated enrollment via the BYOD flow.

ISE uses a variety of probes, including DHCP, HTTP, and SNMP, to collect device metadata.

The sponsor portal is used by internal users to manage the lifecycle of guest accounts, such as creating, approving, or extending them.

Script remediation actions require you to provide the script code directly in the ISE GUI under the remediation definition.

The BYOD/Registration dashboard widgets provide real-time visibility into the number of registered vs. pending devices.

The Network Device property is used to filter policy sets based on the RADIUS client (WLC) IP or device profile.

TACACS+ is the industry standard for command-level authorization; RADIUS is typically limited to shell/privilege level access.

The Cisco-AV-Pair 'url-redirect' is the standard attribute used in a RADIUS Accept message to inform the switch to redirect web traffic to the ISE guest portal.

Administration > System > Deployment provides the status dashboard for all nodes in the cluster.

Authorization Profiles define the permissions for the user. By assigning a specific dACL that permits access to the printer, you allow that traffic.

The 'Provisioning' resources tab in the ISE portal configuration lists the resources generated for different operating systems.

The Default policy set acts as a catch-all if no other policy set conditions are matched.

Tunnel-Type and Tunnel-Medium-Type are mandatory RADIUS attributes to signal to a switch that a VLAN assignment is intended.

A standalone model means all personas (PAN, MnT, PSN) are hosted on a single physical or virtual appliance.

Posture status (e.g., Compliant, Non-Compliant) is an attribute available in the Authorization Policy condition builder.

Assigning an SGT to the server subnet and using an SGACL policy that allows only the IT SGT is the most scalable TrustSec approach.

Endpoint Identity Groups are used to organize devices into logical categories, which are then used in Authorization Policies.

This occurs when the Root CA certificate on the client does not match the CA that signed the certificate provided by the ISE server.

A device might be quarantined if it fails compliance, is missing a required certificate, or has an outdated OS version detected by the MDM.

SNMP query requires the network device to be added to ISE and the correct community string to be configured.

The posture requirement, when associated with a client provisioning policy, triggers the AnyConnect agent to begin assessment.

Shell profiles define session attributes and initial privilege levels.

The Shell Profile in TACACS+ policies allows you to define the privilege level assigned to the user session.

LWA requires the NAD to act as the web server for the captive portal, meaning the switch handles the HTTP request interception directly, unlike CWA where the endpoint is redirected to ISE.

The AnyConnect diagnostic logs, the ISE Posture reports, and the Live Logs are the primary sources of truth for investigating posture failures.

The Guest Flow setting determines how the guest session is handled by the ISE, specifically linking the authorization profile to the appropriate portal type.

Device Sensor allows the switch to collect device information and send it to ISE using RADIUS Accounting, reducing the need for SNMP queries.

If no rule matches, ISE hits the default rule, which typically results in a 'Deny' access.

Cisco devices typically support defining multiple TACACS+ server statements in the configuration for failover.

TACACS+ separates authentication, authorization, and accounting, allowing for command-level authorization.

ISE portals allow for extensive customization of the UI, including the text displayed and the inclusion of specific fields like terms of use or registration forms.

Guest types allow you to define common parameters like account duration, password requirements, and access permissions that can be applied to guest accounts.

The NSA is a small utility downloaded by the endpoint to configure the supplicant for secure wireless network access.

ISE evaluates policy sets first, then moves to the selected policy set to evaluate individual rules. Within a set, authentication rules are checked before authorization rules.

Standard RADIUS attributes follow specific RFC formats; custom vendor-specific attributes (VSAs) are used for Cisco proprietary functions.

The 'Live Logs' in ISE provide real-time visibility into authentication attempts, including the specific failure reason (e.g., 'invalid credentials', 'user account expired').

Posture requires a working authorization profile, a properly provisioned agent, and a clear communication path between the agent and the ISE Policy Services Node (PSN).

The 'AnyConnect Compliance Module' (formerly known as the posture module) is required.

The shared secret is used to encrypt the TACACS+ packet body and authenticate the connection between the client and server.

If no remediation is defined, the device simply remains in a non-compliant state, and the authorization policy usually denies access or places it in a restricted VLAN.

The VLAN ID is configured within the Authorization Profile, which is then selected as the result of an Authorization Policy rule.

The 'Pending' state indicates that the sponsor or an administrator has not yet approved the account creation request, which is a common security feature in guest access flows.

The 'Mandatory' setting in the Posture Requirement forces the agent to report status and remediate if necessary, whereas 'Optional' allows the user to skip.

The three standard ISE personas are Policy Administration Node (PAN), Monitoring and Troubleshooting Node (MnT), and Policy Service Node (PSN).

The 'Policy Service' node must have the RADIUS/TACACS+ service enabled in its configuration.

The most common causes are certificate validation errors and network connectivity issues (e.g., blocked ports).

The 'Idle Timeout' attribute in the Shell Profile controls the duration of inactivity allowed for a TACACS+ session.

You can verify matches in the Live Logs and the Policy Simulation tool.

The guest workflow typically involves the guest user, a sponsor who validates the access, and the ISE engine that enforces the policy.

If authorization is enabled but no command set is assigned, ISE returns a 'deny' for all commands by default.

You can define a failed authentication rule or check the authentication policy's 'continue' options.

The Feed Service updates the Profiler dictionary. If the OUI or device signature is not updated in the local dictionary, ISE cannot match the attributes gathered by the probes.

Monitoring mode allows the admin to see if 802.1X/MAB would pass or fail without actually blocking traffic.

The two core requirements are enabling the BYOD portal and configuring the authorization policy to handle the registration flow.

CWA requires a properly configured redirect ACL on the NAD and a corresponding authorization profile in ISE that points the client to the portal.

The switch must be configured for Cisco TrustSec (CTS) and be capable of processing the SGT attribute sent in the RADIUS response.

The PSN will continue to handle existing sessions and new authentications using the cached policy, but configuration changes cannot be pushed.

Cisco ISE Feed Service updates do not overwrite custom policies; they only add or update predefined policies in the 'Cisco' folder.

A policy set requires a name, a set of conditions that trigger the policy set, and an authentication policy (which includes a sequence).

A higher threshold requires more matching attributes, making the profiling more restrictive and potentially less likely to match.