Migrating a Financial Firm From Shared PSK to 802.1X and IoT Segmentation
A financial services firm has 300 APs on a Cisco 9800-40 HA SSO pair, 6,000 employees, and 1,200 IoT devices including cameras, badge printers, and environmental sensors. The corporate SSID uses WPA2-PSK with a shared key that has not changed in two years; IoT uses the same SSID. An audit requires 802.1X for employees, device identity for IoT, and guest isolation. The firm has Cisco ISE 3.x, but no certificate authority for EAP-TLS yet. Employees use Windows and macOS laptops and iOS/Android phones. The security team wants to avoid a disruptive cutover. You must design the authentication, segmentation, and migration.
1. Design the authentication architecture for employees and IoT.
Read the worked answer
Separate the SSIDs by device class. For employees, use WPA3-Enterprise or WPA2-Enterprise with 802.1X and EAP-TLS once a certificate authority and device certificates are in place. Use ISE as the RADIUS server and push certificates through Group Policy for Windows and MDM or SCEP for macOS and mobile devices. If EAP-TLS cannot be ready for all devices on day one, run PEAP-MSCHAPv2 as an interim for a limited pilot, but do not leave the shared PSK in place. For IoT, do not put cameras and printers on the employee SSID. Use a dedicated IoT SSID with Identity PSK on the 9800 and ISE, assigning a unique pre-shared key per device group, or use MAB with profiling where the device supports it. Cameras and sensors often cannot do 802.1X, so iPSK gives per-group credential separation without a shared campus key. Use CoA from ISE to reauthenticate or quarantine devices when policy changes.
2. How would you segment the traffic and enforce policy?
Read the worked answer
Assign different VLANs and subnets per device class: employee, IoT-camera, IoT-printer, IoT-sensor, and guest. Use Security Group Tags with inline tagging or SXP from the 9800 so policy follows the user or device rather than the subnet. In ISE, create authorization profiles that assign the SGT and a downloadable ACL or a fabric policy. Deny IoT-to-employee and IoT-to-IoT traffic by default, allow only the specific management flows the cameras and sensors need, and send guest traffic only to the Internet. Put a firewall or fabric border between the IoT VLANs and the corporate core. Do not rely on VLANs alone for security, because a flat IoT VLAN lets a compromised camera reach other cameras. Test the policy with real devices, including the badge printer's server flows, before enforcing closed mode.
3. What migration sequence minimizes disruption?
Read the worked answer
Run the new SSIDs in parallel with the old SSID, but put ISE in monitor mode first so you can see which devices would pass or fail without blocking them. Pilot 50 to 100 users across Windows, macOS, and mobile, and pilot one group of IoT devices. Fix certificate enrollment, supplicant settings, and printer or camera flows before expanding. Then move employee groups in waves, using ISE CoA to reauthenticate. Disable the old PSK SSID only after the pilot and waves are complete, and change the old key immediately if it must remain temporarily. For IoT, move devices by group and verify each device's traffic. Keep a documented fallback: an isolated onboarding SSID with limited access, not the old flat PSK. After cutover, enable rogue detection and WIPS, restrict management access to HTTPS and SSH with AAA, and review ISE logs for failed authentications.