Cisco Ise

---
name: cisco-ise
description: "Expert agent for Cisco Identity Services Engine (ISE). Covers 802.1X (EAP-TLS, PEAP), RADIUS, TACACS+, endpoint profiling, posture assessment, guest access, BYOD, pxGrid, TrustSec SGT segmentation, and distributed PAN/MnT/PSN deployment. WHEN: \"Cisco ISE\", \"ISE\", \"802.1X\", \"RADIUS policy\", \"TACACS+\", \"TrustSec\", \"SGT\", \"pxGrid\", \"ISE profiling\", \"posture assessment\", \"NAC\", \"guest portal\", \"BYOD\"."
license: MIT
---

# Cisco ISE

This skill covers Cisco Identity Services Engine (ISE), the enterprise-grade NAC and identity policy platform. It has deep knowledge of 802.1X authentication, RADIUS/TACACS+ policy, endpoint profiling, posture assessment, TrustSec segmentation, pxGrid integration, and distributed ISE deployment.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Authentication policy** -- 802.1X, MAB, RADIUS; apply authentication flow knowledge
   - **Authorization policy** -- VLAN assignment, dACL, SGT; apply authorization guidance
   - **Device admin** -- TACACS+; apply TACACS+ guidance
   - **Architecture** -- Load `references/architecture.md` for node roles and deployment
   - **Profiling** -- Endpoint classification and profiling probe configuration
   - **Posture** -- AnyConnect posture, compliance checks
   - **Troubleshooting** -- Apply diagnostic methodology below

2. **Identify ISE version** -- ISE 3.x is current. Key features differ across 2.x/3.x. Ask if unclear.

3. **Gather context** -- Network vendor (Cisco/non-Cisco), environment size, existing PKI (for EAP-TLS), AD integration, deployment scale (devices/endpoints).

4. **Recommend** -- Provide specific ISE policy configuration guidance, troubleshooting steps, and verification commands.

## Core Expertise

### 802.1X Authentication Framework

802.1X is port-based NAC. Three components:
- **Supplicant** -- Device requesting access (configured with 802.1X client)
- **Authenticator** -- Switch/AP enforcing access (sends RADIUS to ISE)
- **Authentication Server** -- ISE making the authentication decision

**Authentication flow:**
```
1. Device connects to switch port
2. Switch sends EAP-Request/Identity to device
3. Device responds with identity (username, machine name)
4. Switch wraps EAP in RADIUS Access-Request to ISE
5. ISE performs authentication against identity store (AD, LDAP, internal)
6. ISE sends RADIUS Access-Accept with authorization attributes (VLAN, dACL, SGT)
7. Switch applies the authorization result
```

### EAP Methods

| Method | Auth Type | Use Case | Notes |
|---|---|---|---|
| **EAP-TLS** | Certificate-based | Managed corporate devices | Most secure; requires PKI and client certs |
| **PEAP-MSCHAPv2** | Password in TLS tunnel | User auth with AD credentials | Common for users; vulnerable to rogue AP attacks |
| **EAP-FAST** | Cisco proprietary | Cisco environments needing fast re-auth | Supports PAC provisioning |
| **EAP-CHAP** | Password | Legacy, avoid | No TLS wrapper; less secure |
| **MAB (MAC Auth Bypass)** | MAC address | Non-802.1X devices (IoT, printers) | MAC can be spoofed; use as fallback only |

**EAP-TLS certificate requirements:**
- Client certificate with Subject Alternative Name matching the device identity
- Root CA trusted by ISE
- OCSP or CRL check configured for certificate revocation
- For machine auth: certificate issued to computer account (AD CS with certificate template)
- Recommended: Cisco ISE CA or Microsoft AD CS with auto-enrollment

### Authentication Policy

ISE authentication policy determines WHICH authentication method to use:

```
Authentication Policy (simplified):
  IF Wired_802.1X
    THEN Use: [DOT1X] + Identity Source: [AD]
  IF Wireless_802.1X  
    THEN Use: [DOT1X] + Identity Source: [AD]
  IF Wired_MAB
    THEN Use: [MAB] + Identity Source: [Internal Endpoints]
```

**In ISE 3.x (Policy Sets):**
Policy Sets replace the flat authentication/authorization policy structure. A Policy Set groups authentication and authorization rules for a logical use case:

```
Policy Set: "Corporate Wired"
  Conditions: DEVICE:Device Type EQUALS All Device Types:Switch
              AND RADIUS:NAS-Port-Type EQUALS Ethernet
  
  Authentication Policy:
    Rule: Dot1X    | If: 802.1X     | Identity Store: Active Directory
    Rule: MAB      | If: Host Lookup | Identity Store: Internal Endpoints
    Default: DenyAccess
  
  Authorization Policy:
    Rule: Corp Windows  | If: AD:Group=Domain Computers AND PostureStatus=Compliant | Allow: VLAN=Corp, SGT=Employee
    Rule: Corp User     | If: AD:Group=Domain Users AND ISE:PostureStatus=Compliant  | Allow: VLAN=Corp, dACL=Corp_ACL
    Rule: Non-Compliant | If: PostureStatus=NonCompliant                             | Allow: VLAN=Remediation, dACL=Remediate
    Rule: Guest Device  | If: ISE:GuestType=Guest                                    | Allow: VLAN=Guest, dACL=Internet_Only
    Default: DenyAccess
```

### Authorization Profiles and Results

After authentication, ISE returns authorization attributes that the switch/AP applies:

**VLAN assignment:**
```
Authorization Profile:
  Name: Corp_Employee
  Access Type: ACCESS_ACCEPT
  VLAN:
    VLAN ID/Name: 100  (or Corp_VLAN)
```

**Downloadable ACL (dACL):**
```
dACL Name: Corp_Employee_ACL
Content:
  permit tcp any host 10.0.1.100 eq 443    # Allow HTTPS to web server
  permit udp any host 10.0.0.1 eq 53       # Allow DNS
  deny ip any 10.100.0.0 0.0.255.255       # Block PCI segment
  permit ip any any                         # Allow all other
```

**Security Group Tag (TrustSec):**
```
Authorization Profile: Corp_Employee
  Security Group: Employee  (SGT 10)
```

### TACACS+ (Device Administration)

ISE provides TACACS+ for network device administration (login to switches, routers, firewalls):

**TACACS+ vs RADIUS:**
| Feature | TACACS+ | RADIUS |
|---|---|---|
| Use case | Device administration | Network access |
| Encryption | Encrypts entire body | Encrypts only password |
| Protocol | TCP/49 | UDP/1812,1813 |
| Accounting | Separate per-command | Combined |
| Authorization | Command-by-command | All at once |

**Device Admin Policy Set configuration:**
```
Policy Set: "Network Device Admin"
  Conditions: DEVICE:Location EQUALS All Locations
  
  Authentication Policy:
    Rule: AD Auth | Identity Store: Active Directory
    Default: DenyAccess
  
  Authorization Policy:
    Rule: Network Admin  | If: AD:Group=Network-Admins  | Shell Profile: Full-Access + Priv15
    Rule: NOC Operator   | If: AD:Group=NOC-Operators   | Shell Profile: ReadOnly + Priv1
    Rule: Security Team  | If: AD:Group=Security-Ops    | Shell Profile: Security-Commands
    Default: DenyAccess
```

**Command authorization sets:**
```
Command Set: "Full-Access"
  Permit: .*   # Allow all commands

Command Set: "ReadOnly"  
  Permit: show .*
  Deny: .*
```

### Endpoint Profiling

ISE profiles endpoints by collecting attributes from multiple probes to classify device types (Windows PC, iPhone, printer, IP camera, etc.).

**Profiling probes:**
| Probe | Method | Key Data |
|---|---|---|
| **DHCP** | Snooping DHCP requests | DHCP options (60, 55, 43), hostname |
| **HTTP** | Redirect HTTP to ISE | User-Agent string |
| **RADIUS** | From RADIUS auth requests | Called-Station-ID, NAS port type |
| **NetFlow** | NetFlow from network devices | Traffic patterns, ports used |
| **SNMP** | SNMP queries to switches | Connected interface, CDP/LLDP neighbor |
| **DNS** | DNS queries for endpoint | Reverse DNS lookups |
| **NMAP** | Active scan (optional) | Open ports, OS fingerprint |

**Profiling configuration (Policy > Profiling):**
- Enable probes that your network supports
- DHCP and RADIUS probes are lowest-impact (passive)
- HTTP redirect requires ACL on switch to redirect unknown devices
- NMAP probe is active and requires caution in sensitive environments

**Custom profiling policies:**
```
Profile: Custom_IoT_Device
  Conditions:
    AND: DHCP:dhcp-class-identifier CONTAINS "CustomDevice"
    AND: DHCP:dhcp-requested-address IS NOT EMPTY
  Certainty Factor: 30 (MATCHED)
  
  System Result: Custom_IoT_Profile
```

### Posture Assessment

ISE validates device compliance before granting full network access.

**Posture workflow:**
1. Device authenticates (802.1X or MAB)
2. ISE grants limited access (redirect ACL to ISE posture portal)
3. AnyConnect Posture module checks compliance conditions
4. AnyConnect reports posture result to ISE via RADIUS CoA
5. ISE updates authorization to full access or remediation

**Posture conditions (examples):**
- Windows OS patch level (specific KB required)
- Antivirus installed and definitions current
- Disk encryption enabled (BitLocker)
- Specific process running (EDR agent)
- Firewall enabled
- Domain membership

**Configuration:**
```
Posture Policy:
  Name: Windows_Corporate_Posture
  
  Requirements:
    OS Condition: Windows 10 or 11
    AV Condition: [AnyConnectAV] Installed and Definitions within 7 days
    Patch Condition: [WindowsUpdate] No critical patches missing
    Encryption: [BitLockerCheck] System Drive encrypted
  
  Remediation Actions:
    Launch URL: https://wsus.corp.local  (for patching)
    Message: "Install AV from Software Center"
```

**CoA (Change of Authorization):**
ISE sends RADIUS CoA to update an already-connected device's authorization without requiring re-authentication:
- Used after posture result received
- Used after manual remediation by admin
- Used when endpoint profile changes (VLAN/ACL update)

### Guest Access

ISE provides guest access with customizable captive portals:

**Guest flow:**
1. Guest device connects to wireless SSID
2. RADIUS auth: device is unknown, authorization = redirect to guest portal
3. Guest opens browser, hits any HTTP page, gets redirected to ISE guest portal
4. Guest registers (self-registration) or is sponsored by employee
5. ISE creates temporary guest account
6. Guest authenticates to portal
7. ISE sends CoA to update authorization to guest internet access

**Portal types:**
- **Hot Spot** -- No authentication; accept AUP and get access
- **Self-Registered Guest** -- Guest creates own account (with optional approval)
- **Sponsored Guest** -- Employee (sponsor) creates guest account
- **BYOD** -- Employee onboards personal device with certificates

### pxGrid

pxGrid (Platform Exchange Grid) allows ISE to share contextual identity data with other security tools:

**Capabilities:**
- **Session Directory** -- Share IP-to-identity mapping with SIEM, firewall, SOAR
- **TrustSec** -- Publish SGT bindings to pxGrid consumers
- **Adaptive Network Control (ANC)** -- Allow external systems to quarantine endpoints via ISE
- **MDM** -- Mobile device posture from MDM platforms (Intune, Jamf)
- **Threat-Centric NAC** -- Receive threat events (from Stealthwatch, Rapid7, etc.) and auto-quarantine

**pxGrid consumers:**
- Cisco Stealthwatch / Cisco Secure Network Analytics
- Cisco Firepower / FTD (dynamic SGT-based firewall rules)
- Splunk (ISE app for Splunk)
- Microsoft Sentinel
- Palo Alto Networks NGFW
- Third-party SIEM and SOAR platforms

## Troubleshooting

### RADIUS Authentication Failures

**Check Operations > Live Logs in ISE:**
- Provides real-time authentication attempt results
- Shows exact failure reason (e.g., "Authentication failed: No matching rule", "Certificate validation failure")
- Click on an event to see detailed diagnostic steps

**Common failure reasons and fixes:**

| Failure | Cause | Fix |
|---|---|---|
| `15039 - Rejected per authorization profile` | AuthZ rule matched but result is DenyAccess | Review authorization policy rules order |
| `12321 - PEAP failed SSL handshake` | ISE cert not trusted by supplicant | Install ISE root CA on endpoints |
| `24408 - User not found` | AD lookup failure | Check AD join status, AD probe configuration |
| `11036 - RADIUS packet is of type Access-Request` then no match | No matching authentication policy rule | Review authentication policy conditions |
| `22056 - Subject not found in applicable identity store` | Machine not in expected AD group | Verify AD group membership |

**Supplicant-side debugging:**
```powershell
# Windows - Show 802.1X status
netsh lan show interfaces
netsh wlan show interfaces

# Enable detailed 802.1X logging
netsh trace start capture=yes persistent=yes traceFile=C:\dot1x.etl
netsh trace stop
```

**Switch-side debugging (Cisco IOS):**
```
# Enable 802.1X debugging
debug dot1x all
debug radius

# Show 802.1X port status
show dot1x all
show dot1x interface GigabitEthernet0/1

# Show RADIUS server status
show radius server-group all
show aaa servers
```

### TACACS+ Debugging

```
# IOS device debugging
debug tacacs
debug aaa authentication
debug aaa authorization
debug aaa accounting

# Show TACACS server status
show tacacs
show aaa servers

# Test TACACS from IOS
test aaa group TACACS_SERVERS admin Password! legacy
```

### ISE Health Checks

```bash
# In ISE CLI (admin shell)
show application status ise
show version
show interface
show ntp

# In ISE GUI
Administration > System > Deployment  -- Check node health
Operations > Reports > Audit > Change Config Audit  -- Config changes
Administration > System > Health Dashboard  -- System metrics
```

## Common Pitfalls

1. **Not running in Monitor Mode first** -- Enabling enforcement on day one without building device inventory causes legitimate device outages. Always run in monitor mode for 30-90 days first.

2. **Inadequate PKI for EAP-TLS** -- EAP-TLS is the most secure method but requires a working PKI. Without client certificate auto-enrollment, devices can't authenticate after cert expiration.

3. **Wrong policy set order** -- Policy Sets are evaluated top-to-bottom; the first match wins. A catch-all policy set at the top blocks more specific sets below it.

4. **CoA not working** -- RADIUS CoA requires the switch to be configured with `aaa server radius dynamic-author` and the ISE PSN IP as the client. Missing this breaks posture and profiling-triggered updates.

5. **Not configuring ISE HA** -- A single PSN is a single point of failure for all network access. Always deploy at minimum two PSNs for production.

6. **Profiling without understanding probe impact** -- NMAP probe performs active scanning which can trigger IDS alerts or disrupt sensitive OT devices. Understand each probe's impact before enabling.

## Reference Files

Load these when you need deep knowledge for a specific area:

- `references/architecture.md` -- ISE node roles (PAN/MnT/PSN), distributed deployment, RADIUS proxy, pxGrid architecture, TrustSec SGT propagation, high availability design. Read for deployment architecture and scaling questions.