Secure Network Access
Secure Network Access covers how a user or device is identified, authorized, postured, and admitted - centered on Cisco ISE, 802.1X, MAB, web auth, and TrustSec tagging. Expect scenario items that hinge on which method is possible for a given device and which protocol carries which function.
Authentication methods
802.1X has three roles: supplicant (client), authenticator (switch or wireless controller), and authentication server (ISE, speaking RADIUS). EAP methods: EAP-TLS uses mutual certificates and is the strongest; PEAP uses a server certificate with an inner MSCHAPv2 credential; EAP-FAST uses a PAC. MAB sends the MAC address as both username and password for devices with no supplicant (printers, cameras, legacy). Web auth redirects to a browser portal, typical for guests and BYOD. Methods are tried in the configured authentication order, and 802.1X should precede MAB.
ISE policy construction
Policy sets select on conditions (device, location, protocol). Identity policy resolves the identity store; authorization policy maps identity plus posture plus profiling to a result profile: permit, deny, VLAN, downloadable ACL, SGT, or a redirect to a portal. Profiling identifies device type from probes (DHCP, CDP/LLDP, HTTP, SNMP) rather than credentials. Posture uses the Cisco Secure Client posture module to check patch level, antivirus, and disk encryption. CoA (RFC 5176) lets ISE reauthorize an already-connected session - this is what makes rapid threat containment possible.
TACACS+ versus RADIUS
RADIUS (UDP 1812/1813) is for network access, encrypts only the password, and combines authentication and authorization. TACACS+ (TCP 49) is for device administration, encrypts the entire payload, and separates authentication, authorization (including per-command), and accounting.
Worked example
A printer cannot authenticate with 802.1X. Diagnostics show no supplicant, so MAB must be enabled on the port and placed after 802.1X in the authentication order. The MAC is then matched against an endpoint identity group; if unknown, the port falls to the guest or critical VLAN. A profiling probe can later classify it as a printer and reauthorize it with CoA into the correct VLAN - no manual port change required.
Traps that cost marks
Using RADIUS for per-command device administration instead of TACACS+; confusing multi-domain (one voice plus one data device) with multi-auth (multiple clients authenticated separately); thinking 802.1X encrypts traffic; and forgetting that MAB is spoofable and CoA must be enabled for reauthorization.
Visibility and Enforcement
Visibility and Enforcement closes the exam with the telemetry-to-action chain: how Cisco gathers context (flows, tags, identity) and then enforces a decision. Items typically ask which technology provides a given visibility, or which enforcement point can act on it.
TrustSec and SGTs
A Security Group Tag is a 16-bit value representing a role, not an IP or subnet. Classification can be static (configured on a port or VLAN), dynamic (assigned by ISE during authorization), or learned from another device via SXP for hardware that cannot carry inline tags. Enforcement happens through SGACLs, which are applied in a matrix of source and destination tags. Tags travel inline only if every hop supports it; otherwise SXP or a firewall with SGT awareness enforces.
Flow and metadata telemetry
NetFlow and Flexible NetFlow export flow records - source, destination, ports, bytes, timestamps - but no payload. IPFIX is the standardized successor. Cisco Secure Network Analytics (formerly Stealthwatch) collects flows from routers, switches, and firewalls to build behavioral baselines and detect anomalies such as internal scanning or beaconing. Encrypted Traffic Analytics infers maliciousness from flow metadata, packet length and sequencing, and TLS handshake fields such as the initial data packet - no decryption needed.
Context exchange and enforcement points
pxGrid shares identity, device, and threat context with ecosystem tools. That is what enables Rapid Threat Containment: a threat tool flags an endpoint, ISE applies CoA to move the port to a quarantine SGT, and switches or firewalls block that tag. Other enforcement points: FTD access control using SGT matching, downloadable ACLs from ISE, Catalyst Center assurance for network health and device configuration. SIEMs consume syslog and flows for correlation; ERSPAN carries mirrored traffic to analysis tools.
Worked example
An analyst sees a workstation beaconing to a suspicious address over TLS. NetFlow shows a regular small outbound flow, and ETA flags suspicious packet-length distribution without decryption. Secure Network Analytics raises an alarm; pxGrid notifies ISE, which issues CoA to reauthorize the port into a quarantine SGT; SGACLs on the access switch and an SGT rule on the firewall then block workstation traffic while the endpoint is investigated. Each step uses a different tool, and the item will ask which one provides which function.
Traps that cost marks
Treating an SGT as an IP-based ACL; assuming SXP is needed everywhere rather than only on non-capable devices; expecting NetFlow to reveal payload content; believing ETA requires decryption; and confusing Catalyst Center assurance with ISE enforcement.