Cisco 300-715 SISE key terms

The top-level container in Cisco ISE that groups authentication and authorization rules. Each policy set matches traffic by protocol or condition, so different rule trees apply to wired, wireless, VPN, or device-admin requests.

The first-stage rule table inside a policy set that decides which identity store or method validates a user or endpoint. It selects the database and the protocol, such as PEAP against Active Directory or MAB against internal endpoints.

The rule table evaluated after identity is confirmed. It matches conditions such as group membership, posture status, or device type and returns a result, typically a downloadable ACL, VLAN, SGT, or dACL reference.

An ordered list of identity sources that ISE queries one after another until a match is found. It allows fallback from a primary directory to a local identity store when the first source is unavailable or lacks the user.

The built-in user and endpoint database hosted inside ISE. It is commonly used for local administrator accounts, guest sponsor accounts, and endpoints, and it does not depend on an external directory being reachable.

A directory or database outside ISE, such as Active Directory, LDAP, or a RADIUS token server, that ISE joins or queries to validate credentials and retrieve group attributes used in policy conditions.

The operation that registers an ISE node as a member of an AD domain so it can authenticate users with Kerberos or LDAP and read group membership. It requires domain credentials and correct DNS and time sync.

The ISE configuration that retrieves AD security groups and makes them available as policy conditions. Administrators select which groups to import so authorization rules can match on directory group membership.

MAC Authentication Bypass. The switch or controller sends the endpoint MAC address as both username and password to ISE, which checks the endpoint identity store. It is used for devices that cannot do 802.1X.

An IEEE port-based access control standard using EAP over LAN. The supplicant authenticates to the switch or wireless controller, which relays credentials to ISE as the RADIUS server before opening network access.

Extensible Authentication Protocol. A framework that carries authentication methods between supplicant and server. Common EAP types in ISE deployments include PEAP, EAP-TLS, EAP-TTLS, and EAP-FAST.

An EAP method where both client and server present X.509 certificates. It is the strongest common method for 802.1X because it avoids password exchange, but it requires certificate provisioning to every endpoint.

Protected EAP. It builds a TLS tunnel using a server certificate, then carries an inner method such as MS-CHAPv2 for user credentials. Clients must trust the server certificate to avoid rogue-server attacks.

An 802.1X authentication performed by the computer account before any user logs in. It lets ISE grant domain-joined machines limited or full access while the device boots or sits at the login screen.

The client software on an endpoint that responds to 802.1X requests, such as the native Windows or macOS supplicant or Cisco Secure Client. Its configuration determines which EAP methods and certificates are used.

The process where ISE identifies endpoint type and operating system by collecting attributes such as MAC OUI, DHCP fingerprint, HTTP user agent, and NetFlow. Profiles then feed authorization policy conditions.

A data collection method that gathers endpoint attributes for profiling, such as RADIUS, DHCP, SNMP, NetFlow, or HTTP. Probes must be enabled and reachable from ISE for profile matching to work.

A static or logical grouping of endpoints inside ISE. Groups can be assigned automatically by profiling or manually by an administrator, and they are commonly referenced in authorization conditions.

Change of Authorization. A RADIUS message that ISE sends to a network device to re-evaluate or terminate an existing session, for example after posture assessment or when an administrator changes a policy.

The assessment of an endpoint's compliance with security requirements, such as antivirus status or OS patches. Posture policies run after authentication and can trigger remediation or restricted access.

The client component, typically Cisco Secure Client with the posture module, that reports endpoint condition to ISE. It receives posture requirements, runs checks, and can launch remediation actions.

The action returned to a network device after an authorization rule matches. Examples include a downloadable ACL, VLAN assignment, SGT, URL redirect, or a deny result that blocks access.

An access control list stored on ISE and pushed to a network device during authorization. It centralizes ACL management so switches and controllers do not need identical local lists configured.

A 16-bit value assigned to traffic in Cisco TrustSec. ISE can return an SGT as an authorization result, and enforcement devices use it to apply group-based policy instead of IP-based ACLs.

Cisco's group-based access control architecture. It assigns security group tags to identities and applies policy based on tag pairs, simplifying rule sets compared with address-based ACLs across large networks.

Security Group Exchange Protocol. It carries SGT-to-IP bindings between TrustSec-capable and non-capable devices so that older hardware can still participate in group-based policy enforcement.

Security Group ACL. A permission matrix entry that defines whether traffic from a source SGT to a destination SGT is allowed or denied. Enforcement devices download these rules from ISE.

A Cisco-developed protocol used for device administration. It separates authentication, authorization, and accounting and lets ISE control which commands an administrator may run on network devices.

A TACACS+ feature where each command an administrator types is checked against policy before execution. ISE returns permit or deny per command, enabling granular control over device configuration access.

The use of ISE to authenticate and authorize administrators who log in to network devices. It typically uses TACACS+ and can restrict commands, record sessions, and enforce privilege levels.

The protocol used between network access devices and ISE for network access authentication, authorization, and accounting. It carries EAP messages and returns attributes such as VLAN or ACL.

A browser-based login method where a user is redirected to an ISE portal to enter credentials. It is used when 802.1X is unavailable, such as for guest devices or unmanaged endpoints.

A flow where the switch or controller performs MAB, ISE returns a redirect URL, and the user authenticates through a portal. ISE then sends a CoA to apply the final authorization result.

A customizable web page hosted by ISE where guests register or log in. Portal behavior, such as sponsor approval, self-registration, or login, is defined by the guest portal configuration.

A user, often an employee, who creates and approves guest accounts through the sponsor portal. Sponsor rights are controlled by identity group membership and guest portal settings.

A temporary credential issued to a visitor, with a defined start and end time. Guest accounts are stored in ISE and can be created by sponsors or by self-registration with approval.

The entity that issues and signs certificates used by ISE and endpoints. ISE can act as a local CA or use an external CA, and clients must trust the issuing chain for EAP-TLS and portal TLS.

A single ISE appliance or virtual machine in a deployment. Nodes take roles such as policy service, monitoring, or administration, and their personas determine which functions they perform.

The role assigned to an ISE node, such as Policy Administration, Policy Service, Monitoring, or pxGrid. Personas can be combined on small deployments but are usually separated in larger ones.

The collection of ISE nodes that share configuration and operate together. A deployment has a primary administration node, and joining nodes requires consistent versions, time, and certificates.

A publish-subscribe platform that shares contextual data such as endpoint identity and session details among Cisco and third-party products, enabling integrated response and policy decisions.