300-715

300-715 SISE Exam Details

Exam Domain Weight Breakdown

Certification Path & Prerequisites

The 300-715 SISE is one of the concentration exams for the CCNP Security certification. To earn CCNP Security, you must pass the core exam (350-701 SCOR) plus one concentration exam such as SISE. This exam focuses exclusively on Cisco ISE deployment, configuration, and troubleshooting. ISE is the cornerstone of Cisco's zero-trust and identity-based network access strategy, serving as the centralized policy engine for authentication, authorization, and accounting (AAA) across wired, wireless, and VPN connections.

Cisco recommends 3-5 years of experience with enterprise networking and security, along with familiarity with ISE administration, 802.1X, RADIUS, and network access control concepts before attempting this exam.

Tip: The exam heavily tests hands-on ISE configuration scenarios. Lab practice with ISE virtual appliances is essential for success.

ISE Node Personas

Cisco ISE uses a persona-based architecture. Each ISE node can run one or more personas depending on the deployment model. Understanding which persona handles which function is critical for the exam.

Deployment Models

Tip: In a distributed deployment, you can have max 2 PAN nodes, max 2 MnT nodes, but multiple PSN nodes (up to 50 in ISE 3.x). PSN nodes are grouped into Node Groups for failover and load distribution.

ISE Licensing (ISE 3.x Smart Licensing)

ISE Certificates

• Admin Certificate: Secures the ISE admin GUI (HTTPS). Presented when administrators access the web portal on port 443.
• EAP Certificate: Used during 802.1X authentication to prove ISE identity to supplicants. Clients validate this certificate during PEAP or EAP-TLS inner/outer tunnel establishment.
• pxGrid Certificate: Mutual TLS authentication between ISE and pxGrid subscribers (e.g., Stealthwatch, FMC).
• Portal Certificate: Presented to users on guest, sponsor, BYOD, and client provisioning portals.
• SAML Certificate: Used for SAML 2.0 SSO integration with external IdPs.
• Internal CA: ISE has a built-in Certificate Authority that can issue certificates for BYOD endpoints during onboarding via SCEP.

Tip: A single certificate can be assigned multiple roles (Admin + EAP + Portal). System certificates are per-node, while Trusted certificates are shared across the deployment.

Network Access Devices (NADs)

NADs are the switches, wireless controllers, and VPN concentrators that act as RADIUS clients to ISE. Configuration involves defining the device in ISE and configuring the device to send RADIUS to ISE PSN nodes.

• Network Device Groups (NDGs): Organize NADs by location, device type, or IPSEC status. Used in policy conditions for location-based or device-type-based policy decisions.
• RADIUS Shared Secret: Pre-shared key between NAD and ISE for RADIUS message integrity. Must match on both sides.
• CoA (Change of Authorization): ISE sends RADIUS CoA (RFC 5176) to NADs to dynamically change session attributes. Port 1700 (Cisco) or 3799 (RFC standard). Supports CoA Push, CoA Reauthenticate, CoA Terminate (port bounce/shutdown).

ISE Authentication Flow

The ISE policy flow processes every RADIUS request through three sequential stages: Authentication, Authorization, and (optionally) Accounting. Understanding this flow is fundamental to ISE configuration.

• Step 1 - Authentication Policy: Determines HOW to authenticate (which identity store, which EAP protocol). Matches on conditions like Wired_802.1X, Wireless_MAB, VPN, etc. Result: allowed protocols + identity source.
• Step 2 - Authorization Policy: Determines WHAT access to grant. Matches on identity group, device type, posture status, location, time, etc. Result: authorization profile (permissions).
• Step 3 - Accounting: Tracks session start, stop, interim updates. Logged to MnT node for reporting and troubleshooting.

Tip: ISE evaluates authorization rules top-down and uses the FIRST match. The default rule at the bottom typically grants limited access (e.g., DenyAccess or PermitAccess).

802.1X Authentication

IEEE 802.1X is the standard for port-based network access control. It uses three components working together:

Protocol flow: Supplicant <--EAPoL--> Authenticator <--RADIUS--> ISE. The authenticator translates EAP over LAN (EAPoL) to RADIUS and back.

EAP Method Comparison

Tip: EAP Chaining (via TEAP or Cisco EAP-FAST) authenticates both the machine and the user in a single EAP session. This enables policies that require both machine AND user authentication to succeed before granting full access.

MAB (MAC Authentication Bypass)

MAB is a fallback authentication mechanism for devices that do not support 802.1X (printers, IP phones, IoT sensors). The switch sends the endpoint's MAC address as the username and password in a RADIUS request. ISE looks up the MAC in an internal endpoint database or external source.

• Authentication order: Typically 802.1X first, then MAB fallback (configured on the switch with authentication order dot1x mab)
• MAB formats: Cisco default is lowercase with hyphens (aa-bb-cc-dd-ee-ff). ISE can normalize different vendor formats.
• Security limitation: MAC addresses can be spoofed. Always combine MAB with profiling for better endpoint identification.

Authorization Profiles & Results

Authorization profiles define the access permissions returned to the NAD via RADIUS attributes. ISE supports multiple enforcement mechanisms:

Identity Sources

Tip: When joining ISE to Active Directory, ISE needs a machine account in AD. Use the AD join operation from the ISE GUI. AD groups can then be used directly in authorization policy conditions.

ISE Profiler Overview

The ISE Profiler dynamically discovers, classifies, and groups endpoints based on their attributes. Profiling enables ISE to identify device types (printers, phones, workstations, IoT) without manual configuration, allowing policy decisions based on device identity rather than just user identity.

• Profiling runs on PSN nodes that collect probe data from endpoints and network infrastructure.
• Certainty Factor (CF): Each profiling policy has a minimum CF threshold. Probe data contributes points; when total CF meets or exceeds the minimum, the endpoint is classified.
• Profiler Feed Service: Cisco provides OUI and profiler policy updates via feed service (requires Advantage license).

Profiler Probes

Tip: DHCP and HTTP probes provide the highest profiling accuracy for most environments. RADIUS probe is always on and provides baseline data. NMAP is the only active probe (ISE initiates the scan); all others are passive.

Profiling Policy & CoA

• Profiling Policies: Hierarchical tree structure (e.g., Cisco-Device > Cisco-IP-Phone > Cisco-IP-Phone-7841). Each policy has conditions and a minimum certainty factor.
• Endpoint Identity Groups: Profiled endpoints are placed into identity groups (e.g., Profiled > Cisco > IP-Phone). These groups can be used in authorization policy conditions.
• CoA on Re-Profile: When an endpoint is re-profiled to a different type, ISE can issue a CoA (RFC 5176) to the NAD, triggering reauthentication. This ensures the endpoint immediately gets the correct authorization based on its new profile.
• Global vs Local CoA: Global CoA applies to all profiling policies. Per-policy CoA can be enabled selectively for critical device types.

Posture Assessment

Posture assessment checks endpoint compliance before granting full network access. ISE evaluates whether the endpoint meets security requirements (antivirus, patches, disk encryption, etc.) and grants access accordingly.

Posture Flow & Remediation

• Step 1: Endpoint authenticates via 802.1X or MAB. ISE authorization policy matches posture-unknown state and assigns limited access (redirect to client provisioning portal).
• Step 2: Endpoint is redirected to ISE client provisioning portal. AnyConnect Posture Module (or Temporal Agent) is downloaded/launched.
• Step 3: Agent performs compliance checks per posture policy. Results sent to ISE.
• Step 4 - Compliant: ISE issues CoA to NAD, reauthenticating endpoint. New authorization grants full access.
• Step 4 - Non-Compliant: Endpoint enters remediation state with limited access. Remediation actions (update AV, install patch) are attempted. If remediation succeeds, posture is re-evaluated.
• Posture Lease: Configurable time period during which a previously compliant endpoint is not re-checked. Reduces disruption for frequently connecting users.

Tip: Posture states are: Compliant, Non-Compliant, Unknown, Not Applicable. Authorization policies should handle all four states to avoid locking out endpoints.

Guest Access Overview

ISE provides comprehensive guest access services including self-registration, sponsored guest accounts, and hotspot portals. Guest workflows typically involve URL redirection to an ISE portal, followed by web-based authentication (WebAuth) before network access is granted.

Sponsor Portal

Sponsors are internal employees who create and manage guest accounts. The Sponsor Portal is a web interface where sponsors can:

• Create individual or bulk guest accounts with specified access duration
• Send credentials via email, SMS, or print
• Extend, suspend, reinstate, or delete guest accounts
• View and manage active guest sessions

Sponsor Groups: Define sponsor privileges (which guest types they can create, max accounts, notification methods). Map to AD groups or ISE internal groups.

Guest Types & Time Profiles

Guest types also define maximum simultaneous logins, endpoint limits, and the guest portal experience (AUP, password change requirements, VLAN assignment).

WebAuth Types

Tip: CWA (Centralized Web Auth) is the recommended approach for ISE deployments. It provides more flexibility, consistent user experience, and full ISE policy enforcement via CoA after authentication.

BYOD Onboarding

BYOD (Bring Your Own Device) onboarding allows personal devices to securely connect to the corporate network. ISE provides a self-service portal for certificate provisioning and device registration.

• Step 1: Employee connects to provisioning SSID and authenticates (usually PEAP with AD credentials)
• Step 2: ISE redirects to BYOD portal (My Devices portal). User registers device.
• Step 3: ISE pushes a native supplicant provisioning profile via AnyConnect or Apple/Android profile. Certificate is provisioned via SCEP (Simple Certificate Enrollment Protocol) from ISE Internal CA.
• Step 4: Device reconnects to corporate SSID using EAP-TLS with the provisioned certificate.
• Step 5: ISE authorizes based on certificate attributes + registered device status.

MDM Integration & Device Registration

Tip: Combine BYOD with MDM for maximum control. ISE handles network access decisions while MDM enforces device-level policies (encryption, passcode, app restrictions). Non-MDM-compliant devices can be redirected to MDM enrollment.

RADIUS vs TACACS+ in ISE

TrustSec: SGT vs Traditional ACL

Tip: TrustSec SGTs are the preferred micro-segmentation approach in modern Cisco networks. SGTs tag traffic at ingress and SGACLs enforce policy at egress, reducing the number of ACL rules from thousands to a simple source-destination SGT matrix.

CoA Types (RFC 5176)

CoA uses UDP port 1700 (Cisco default) or 3799 (RFC standard). ISE sends the CoA; the NAD processes it and responds with CoA-ACK (success) or CoA-NAK (failure).

pxGrid Use Cases & Integrations

ISE Deployment Comparison: Standalone vs Two-Node vs Distributed

Guest Portal Comparison

Posture Agent Comparison

Tip: For the exam, remember the ISE policy processing order: Authentication Policy (who are you?) -> Authorization Policy (what can you access?). Profiling and posture refine the authorization result dynamically via CoA.