Security · Cisco ISE
Plan a clean ISE policy set — authentication, authorization, dACL/SGT, posture, guest — and the migration path from Monitor mode to Low-impact to Closed.
The #1 reason ISE deployments fail: someone flipped Closed mode on a whole campus before finishing Monitor mode. This planner sequences the rollout correctly and gives you the policy-set skeleton: WiredDot1x → CorpAssets, BYOD, Guest, IoT, Failure.
Output: policy set skeleton (conditions/results), authorization profile table, migration sequence, and a closed-mode readiness check. Use this as your design doc going into ISE workshop.
Start in Monitor mode — NADs send RADIUS and ISE logs the hit, but the port isn't restricted. Leave it there for 2-4 weeks while you find MAB-only devices (printers, IoT, door controllers) and profile them. Move to Low-impact: pre-auth ACL permits DHCP/DNS/AD/HTTP while waiting for full authZ. Finally, Closed: no ACL, no access until authZ succeeds.
TrustSec SGTs are strictly better than dACLs for east-west, but only where the network supports propagation (SXP or inline tagging). Dual-path: SGT in DC, dACL at the edge.
Rule of thumb: 1 PSN per 20k concurrent sessions for standalone, less if doing posture. Always N+1 for HA.
EAP-TLS if you have a cert infra — it's phishing-resistant and avoids password churn. PEAP is the fallback.
Policy set WiredDot1x with 4 authZ: CorpAssets (EAP-TLS + AD), BYOD (PEAP + onboarding), Guest (MAB → redirect), IoT_MAB (whitelist). Phase 1 monitor (4w), Phase 2 low-impact (4w), Phase 3 closed.
SGT 10=Finance, 20=HR, 30=Prod, 99=Quarantine. SGACL matrix enforced on DC leaves. SXP to campus for visibility. Quarantine SGT invoked by pxGrid on EDR detection.