I85PREP
⌘ K
CCIE Security study materials
CCIE Security study resources

CCIE Security: Identity and Access Management

CCIE Security · Work through your exam, one topic at a time.

All guide sections

Identity and Access Management

What this domain tests

Identity and Access Management covers Cisco ISE, 802.1X and MAB, RADIUS and TACACS+, EAP methods, guest and BYOD flows, posture, TrustSec integration, and pxGrid context sharing. Expect policy-set reasoning: which identity store, which protocol, and which authorization result applies.

Core rules

  • RADIUS carries network-access authentication and authorization; TACACS+ separates authentication, authorization, and accounting and supports per-command device administration.
  • EAP-TLS uses mutual certificate authentication; PEAP uses a server certificate with an inner method such as MSCHAPv2; TEAP can chain machine and user authentication.
  • MAB uses the MAC address as identity with no cryptographic proof, so it is spoofable and should be constrained by OUI, VLAN, or device profile.
  • ISE policy sets evaluate conditions and return authorization results such as VLAN, DACL, SGT, or URL redirect.
  • Change of Authorization (CoA) reauthenticates or reauthorizes a session after policy changes.
  • pxGrid shares session and identity context with firewalls and other platforms; SAML federates administrative and guest access.

Worked example

A wired switch port must authenticate laptops with a machine certificate before user logon and then with the user certificate. A voice phone on the same port uses MAB. Unauthenticated devices must fail closed.

Reasoning: configure 802.1X with EAP-TLS and machine authentication, then user authentication; TEAP or EAP chaining can carry both in one session. The phone's MAB request matches a separate policy set restricted to the voice OUI and voice VLAN. Authorization returns an SGT and a DACL per result. Set the port to closed mode or a critical VLAN so unauthenticated devices cannot pass traffic. Machine authentication matters because patching and domain policy must run before a user logs on. MAB is acceptable for the phone only because it is OUI-restricted; using it for laptops would let any attacker spoof a MAC.

Traps that cost marks

  • TACACS+ is for device administration; RADIUS is for network access.
  • EAP-TLS fails if the client certificate lacks client-authentication EKU or trust is broken.
  • MAB has no cryptographic identity and is spoofable.
  • CoA requires switch support and correct shared secrets.
  • Clock skew breaks certificate validation and SAML assertions.

Key points

  • RADIUS handles network access; TACACS+ handles device administration and per-command authorization.
  • EAP-TLS requires mutual certificates; PEAP requires a trusted server certificate.
  • MAB is spoofable and should be constrained by OUI or profile.
  • Authorization results can return VLAN, DACL, SGT, or redirect.
  • CoA reauthorizes live sessions after policy changes.
  • pxGrid and SAML share context and federate access.