Implementing Network Access Control with Cisco ISE

Overview

Cisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.

When to Use

• When deploying or configuring implementing network access control with cisco ise capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Cisco ISE 3.1+ appliance or virtual machine (16 CPU cores, 64GB RAM minimum for production)
• Cisco switches with 802.1X support (Catalyst 9000 series recommended)
• Active Directory domain with user and computer accounts
• PKI infrastructure for EAP-TLS certificate-based authentication
• DNS and NTP configured consistently across ISE nodes and network devices
• Supplicant software on endpoints (Windows native, AnyConnect NAM, or SecureW2)

Core Concepts

802.1X Architecture

The 802.1X framework involves three components:

Authentication Flow

1. Endpoint connects to switch port
2. Switch sends EAP-Request/Identity to endpoint
3. Endpoint responds with EAP-Response/Identity
4. Switch forwards credentials to ISE via RADIUS Access-Request
5. ISE authenticates against AD/LDAP/internal store
6. ISE evaluates authorization policy
7. ISE returns RADIUS Access-Accept with attributes (VLAN, dACL, SGT)
8. Switch enforces authorization on the port

Authentication Methods

Workflow

Step 1: Configure ISE for Active Directory Integration

Navigate to Administration > Identity Management > External Identity Sources > Active Directory:

1. Add AD join point with domain name (e.g., corp.example.com)
2. Provide domain admin credentials for ISE machine account
3. Join ISE to the domain
4. Select AD groups for authorization policies:
   • Domain Users - Standard employee access
   • Domain Computers - Machine authentication
   • IT-Admins - Privileged access
   • BYOD-Users - Personal device access

Step 2: Configure Network Devices in ISE

Navigate to Administration > Network Resources > Network Devices:

Name: SW-ACCESS-01
IP Address: 10.0.1.1/32
RADIUS Shared Secret: C0mpl3x$3cretKey!
SNMP Settings: v2c, community string
Device Type: Cisco Switches
Location: Building-A-Floor-1

Create a Network Device Group hierarchy:

Device Type:
  ├── Cisco Switches
  │   ├── Access Layer
  │   └── Distribution Layer
  └── Wireless Controllers
Location:
  ├── Building-A
  └── Building-B

Step 3: Configure Switch for 802.1X

Apply this configuration to the access switch:

! Enable AAA
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
aaa accounting update newinfo periodic 2880

! Configure RADIUS server
radius server ISE-PRIMARY
 address ipv4 10.0.5.10 auth-port 1812 acct-port 1813
 key 0 C0mpl3x$3cretKey!
 automate-tester username radius-test probe-on

radius server ISE-SECONDARY
 address ipv4 10.0.5.11 auth-port 1812 acct-port 1813
 key 0 C0mpl3x$3cretKey!
 automate-tester username radius-test probe-on

aaa group server radius ISE-GROUP
 server name ISE-PRIMARY
 server name ISE-SECONDARY
 deadtime 15

…