Cisco 300-715 SISE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

RADIUS authentication port

ISE receives RADIUS Access-Request messages on UDP port 1812 and sends accounting records to UDP port 1813. Legacy deployments may still use 1645/1646, but 1812/1813 are the standard values.

MAB authentication

MAC Authentication Bypass sends the endpoint MAC address as the RADIUS username with a shared secret as the password. ISE matches it against endpoint identities or endpoint identity groups rather than validating a real credential.

EAP-TLS

A mutual certificate-based EAP method where both client and server present certificates inside the TLS handshake. ISE must trust the client's issuing CA, and the client must trust the ISE EAP certificate.

PEAP-MSCHAPv2

An EAP method that builds a TLS tunnel using only the server certificate, then authenticates the user with MSCHAPv2 inside the tunnel. The client validates the ISE server certificate, so trust must be configured.

Identity Source Sequence

An ordered list of identity stores that ISE queries during authentication. The sequence can stop at the first match or continue to later sources when the user is not found, enabling AD-to-internal fallback.

Active Directory join requirements

ISE joins AD using a service account with sufficient rights; DNS must resolve the domain, and time must be synchronized within five minutes or Kerberos and LDAP lookups fail.

Authorization policy evaluation

ISE evaluates authorization rules top-down within the matched policy set and stops at the first rule whose conditions are all satisfied. The Default rule applies when no earlier rule matches.

Internal endpoint identity

A record in ISE's internal endpoint store keyed by MAC address, holding a static endpoint identity group assignment and profile. It is the primary match source for MAB authentication.

Policy set evaluation order

Policy sets are evaluated in the order configured, top to bottom. The first policy set whose conditions match handles the request; if none match, the Default policy set is used.

Profiling probes

Data sources that feed the profiler: RADIUS, DHCP, SNMP, NetFlow, DNS, HTTP, and NMAP. Each probe must be enabled in the profiler policy and supported by the network device.

Profiler exceptions

Rules that exclude or force endpoints out of automated profiling. Exceptions take precedence over profiler policies, so a statically assigned endpoint identity group is not overwritten by probe data.

Change of Authorization

RFC 5176 mechanism where ISE sends a CoA-Request to re-authorize an active session or a Disconnect-Request to terminate it. The NAD must support CoA and permit UDP 1700 from ISE.

VLAN authorization attributes

To assign a VLAN, the authorization profile returns Tunnel-Type (VLAN), Tunnel-Medium-Type (802), and Tunnel-Private-Group-ID (the VLAN ID) as RADIUS attributes to the NAD.

Security Group Tag attribute

ISE returns an SGT to the NAD as a Cisco AV pair, cisco-av-pair=cts:security-group-tag, inside the authorization profile. The NAD then applies inline tagging or SXP propagation.

dACL in authorization profile

A downloadable ACL referenced by name in the authorization profile. The NAD must have the ACL defined locally or support downloading it from ISE; the profile itself carries only the name.

Posture assessment

AnyConnect ISE posture module reports endpoint condition to ISE. Posture policy evaluates Compliant, Non-Compliant, or Unknown status and can trigger remediation before full network access is granted.

Centralized web authentication

The NAD redirects an unauthenticated client to an ISE-hosted portal. After the user authenticates, ISE sends a CoA to the NAD, which applies the authorized profile.

Guest portal types

Sponsored portals require a sponsor to create credentials; self-registered portals let guests create their own; hotspot portals use click-through with no credentials. My Devices portals handle device registration.

Web redirection AV pairs

The authorization profile returns cisco-av-pair=url-redirect with the portal URL and url-redirect-acl naming the ACL that selects which traffic is redirected. The NAD must support URL redirect.

BYOD onboarding flow

The device portal provisions a client certificate through SCEP or EST after the user registers the device. Subsequent authentications use EAP-TLS with that certificate instead of user credentials.

Guest sponsor groups

Identity groups whose members are permitted to log into the sponsor portal, create guest accounts, and approve self-registered guests. Sponsor authorization is separate from guest authorization policy.

Guest portal certificate

The certificate bound to the guest portal must be trusted by guest clients and must match the portal FQDN in its subject or SAN. A mismatch causes browser certificate warnings and failed redirects.

Security Group Tag

A 16-bit value assigned to traffic that identifies the source's security classification. TrustSec policy matrices use source and destination SGTs to permit or deny flows via SGACLs.

SXP protocol

SXP propagates IP-to-SGT bindings between TrustSec devices over TCP port 64999. It is used where inline tagging is unsupported, and it carries bindings, not the tag in the frame.

SGACL enforcement point

SGACLs are enforced on the egress device that owns the destination, using the policy matrix downloaded from ISE. The source SGT and destination SGT determine which SGACL applies.

TACACS+ device administration

TACACS+ runs over TCP port 49 and supports authentication, per-command authorization, and accounting. ISE uses command sets and shell profiles to control admin privilege and allowed commands.

SGT assignment methods

SGTs can be assigned statically by VLAN-to-SGT or IP-to-SGT mapping, dynamically through RADIUS authorization, or learned from peers through SXP bindings.

ISE node roles

Administration (PAN), Policy Service (PSN), Monitoring (MnT), and pxGrid. A distributed deployment has one primary PAN, an optional secondary PAN, and one or more PSNs.

pxGrid

A context-sharing framework on TCP 8910 that lets ISE publish session and identity data to ecosystem partners such as firewalls, SIEM, and MDM. Mutual certificate authentication is required.

ISE backup and restore

Backups are taken from the PAN and restored to a node running the same ISE version with matching roles. Configuration backups exclude operational data unless monitoring data is explicitly included.

Live Logs

The Monitoring node's real-time view of authentication and authorization events. It shows the matched policy set, rule, identity source, and failure reason, making it the first troubleshooting stop.

Common ISE failure causes

Frequent causes of failed authentications are RADIUS shared secret mismatch, a missing network device entry, certificate trust failure, time skew beyond five minutes, and CoA disabled on the NAD.