Cisco 300-715 SISE cheat sheet

Identity sources supported by ISE: internal users and internal endpoints, Active Directory, LDAP, RADIUS token servers, RSA SecurID, and SAML/OIDC identity providers for guest and BYOD flows.

RADIUS authentication flow: the NAD sends Access-Request to ISE on UDP 1812; ISE returns Access-Accept with AV pairs or Access-Reject; accounting uses UDP 1813.

802.1X EAP types: PEAP-MSCHAPv2 uses a server certificate and validates the client inside a TLS tunnel; EAP-TLS requires certificates on both client and server; EAP-FAST uses PACs; TEAP supports chaining.

MAB sends the endpoint MAC address as the username and a shared secret as the password; ISE matches it against internal endpoint identities or endpoint identity groups, so MAB is identity-by-attribute, not real authentication.

Certificate-based authentication requires ISE to trust the issuing CA in Trusted Certificates; the client must trust the ISE EAP certificate chain, or supplicant validation fails.

AD join requires a valid service account with sufficient rights, correct DNS, and time sync within five minutes; ISE joins as a computer object and uses LDAP or Kerberos-based lookups for group retrieval.

Identity group hierarchy: All_Identities contains internal users and endpoints; AD groups are separate Identity Groups populated by group-mapping rules; authorization rules can match on identity group or AD group membership.

Authorization policy evaluates top-down and stops at the first matching rule; the default rule is Default and typically denies or permits with a low-privilege profile.

Identity Source Sequence defines an ordered list of sources with an option to continue to the next source if the user is not found, allowing AD fallback to internal users.

Policy sets are evaluated in order and contain authentication and authorization policy; if no policy set matches, the Default policy set applies.

Profiling collects attributes through RADIUS probes (DHCP, RADIUS, SNMP, NetFlow, DNS, HTTP, NMAP); each probe must be enabled per profiler policy and per NAD.

Endpoint identity groups are assigned by profiler policy conditions; conditions combine profiler attributes with operators such as equals, contains, and starts with.

Profiler exceptions take precedence over profiler policies and exclude endpoints from automated profiling (for example, static assignments that should not be overwritten).

CoA (RFC 5176) lets ISE change authorization mid-session: Disconnect-Request terminates a session, CoA-Request re-authorizes with new AV pairs; the NAD must support CoA and have the ISE CoA port configured (default UDP 1700).

Authorization profiles carry RADIUS attributes: VLAN (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID), dACL name, SGT (cisco-av-pair cisco-av-pair=cts:security-group-tag), and URL redirect for web auth.

dACLs are named access lists referenced by the NAD and must be defined on the switch or downloaded via a downloadable ACL; the authorization profile references the name only.

Posture assessment requires the AnyConnect ISE posture module; posture policy uses conditions on posture status (Compliant, Non-Compliant, Unknown) and remediation actions.

Change of Authorization and session termination require the NAD to be defined as a network device with the correct RADIUS shared secret and CoA enabled.

Web authentication flow: the NAD redirects the client to the ISE portal, the client authenticates, ISE returns a CoA to the NAD, and the NAD applies the authorized profile.

Centralized web auth uses ISE as the portal; local web auth uses the NAD's own portal; both require an authorization profile with Web Redirection and an ACL redirect type.

Guest portal types: Sponsored (sponsor creates credentials), Self-Registered (guest self-creates), Hotspot (no credentials, click-through), and My Devices for device registration.

Guest accounts can be created in the internal guest user store or in an external LDAP/AD store; sponsor groups determine who can create and approve accounts.

Guest portal customization uses portal themes and language files; guest account settings define duration, sponsor approval, and notification email/SMS templates.

BYOD onboarding uses the device portal with a certificate provisioning flow: the client enrolls via SCEP/EST, receives a client certificate, and later authenticates with EAP-TLS.

The guest portal certificate must be trusted by clients; the portal FQDN must resolve from guest networks and match the certificate subject/SAN.

Web redirection requires the NAD to support URL redirect AV pairs (cisco-av-pair url-redirect and url-redirect-acl) and the client to accept the redirect.

Guest sponsor authentication can use internal users, AD, or SAML; sponsor portals are separate from guest portals and use different portal policies.

TrustSec components: Security Group Tags (SGT), Security Group ACLs (SGACL), and the Security Group Access (SGA) policy matrix that defines which source SGT may reach which destination SGT.

SGT values are 16-bit; inline tagging carries the SGT in the Ethernet frame (802.1AE or CMD), while SXP propagates SGT-to-IP bindings to devices that cannot tag.

SXP uses TCP port 64999; it is a speaker/listener relationship and propagates IP-to-SGT mappings, not the tag itself.

SGACL enforcement happens on the egress device that has the destination; the policy matrix is downloaded from ISE to the NAD via PAC (Protected Access Credential).

Device administration with TACACS+ uses TCP port 49; ISE can authenticate, authorize commands (per-command authorization), and account for admin sessions.

TACACS+ device administration policy uses command sets and shell profiles to control privilege level, allowed commands, and session timeouts.

RADIUS-based device administration uses the Cisco AV pair shell:priv-lvl to set privilege; TACACS+ supports granular per-command authorization that RADIUS cannot.

Network device profiles in ISE define the NAD vendor and supported attributes; the device must be added under Network Devices with the correct IP, shared secret, and device profile.

SGT assignment methods: static VLAN-to-SGT mapping, static IP-to-SGT, dynamic SGT from authorization (RADIUS), and SXP learned bindings.

Deployment models: standalone, distributed (primary and secondary PAN/MnT plus PSNs), and the ISE node roles are Administration, Policy Service, Monitoring, and pxGrid.

A distributed deployment requires a primary PAN; the secondary PAN is a standby that promotes on failure; PSNs handle RADIUS and web auth load.

pxGrid (TCP 8910) shares context between ISE and ecosystem partners (firewalls, SIEM, MDM); it uses certificates for mutual authentication.

Ports to remember: RADIUS 1812/1813, CoA 1700, TACACS+ 49, SXP 64999, pxGrid 8910, LDAP 389/636, HTTPS 443, and ISE admin 443.

Backup and restore: the backup must be taken from the PAN; restore requires matching ISE version and node roles; configuration backups exclude operational data unless the MnT data is included.

Troubleshooting tools: Live Logs and Live Sessions in the MnT node, the ISE CLI (show application status ise, show logging), and the support bundle for TAC.

Common failure causes: shared secret mismatch, missing NAD entry, certificate trust failure, time skew, and CoA not enabled on the NAD.

Upgrades use the ISE Upgrade Bundle; the PAN orchestrates the upgrade across nodes, and the upgrade order is typically MnT/PAN then PSNs.

Integration with external MDM uses the MDM API to register devices and obtain compliance attributes, which feed authorization and posture policy.

Deployment models: standalone, distributed (primary and secondary PAN/MnT plus PSNs), and the ISE node roles are Administration, Policy Service, Monitoring, and pxGrid.

A distributed deployment requires a primary PAN; the secondary PAN is a standby that promotes on failure; PSNs handle RADIUS and web auth load.

pxGrid (TCP 8910) shares context between ISE and ecosystem partners (firewalls, SIEM, MDM); it uses certificates for mutual authentication.

Ports to remember: RADIUS 1812/1813, CoA 1700, TACACS+ 49, SXP 64999, pxGrid 8910, LDAP 389/636, HTTPS 443, and ISE admin 443.

Backup and restore: the backup must be taken from the PAN; restore requires matching ISE version and node roles; configuration backups exclude operational data unless the MnT data is included.

Troubleshooting tools: Live Logs and Live Sessions in the MnT node, the ISE CLI (show application status ise, show logging), and the support bundle for TAC.

Common failure causes: shared secret mismatch, missing NAD entry, certificate trust failure, time skew, and CoA not enabled on the NAD.

Upgrades use the ISE Upgrade Bundle; the PAN orchestrates the upgrade across nodes, and the upgrade order is typically MnT/PAN then PSNs.

Integration with external MDM uses the MDM API to register devices and obtain compliance attributes, which feed authorization and posture policy.