CCIE Security - ISE 2.1.0 Deep Dive: Labs

Explain Cisco ISE, a next-generation identity and access policy platform that gathers real-time contextual data from users and devices to enforce policy across wired, wireless, and remote networks.

Explore Cisco identity services engine features, including network identity awareness, device context awareness, bring your own device capability, centralized guest management, and security policy for wired, wireless, and vpn access.

Explore Cisco ISE identity context awareness by authenticating users via 802.1X or MAB and granting access based on identity from local or central sources such as AD or labs.

Learn Cisco ISE as a centralized policy server to manage policies for 50,000 endpoints, with downloadable ACLs, VLAN assignment via switch or WLC, and dot1x for wired and wireless.

Trace the history of Cisco NAC from early frameworks to the Cisco identity services engine (ISE), including 802.1x, guest server, profiler, and mobile device onboarding.

Explore the Cisco ISE infrastructure components, including Cisco and non-Cisco devices such as Catalyst and Nexus switches and wireless controllers, plus policy components and recommendations like 6500/4500 and 7000/5500 series.

Explore Cisco ISE policy components, including authentication, authorization, accounting, posture, profiling, guest management, 802.1X, MAB, downloadable ACLs, and security group X with central and local policy options.

Explore Cisco ISE endpoint components, including 802.1x supplicants for Windows, Mac, and Cisco AnyConnect, and examine the Cisco NEC agent posture information for Windows.

Cisco identity services engine architecture uses administration personnel, policy service personnel, and monitoring personnel to scale for large networks in standalone and distributed deployments. It defines policy and monitoring nodes.

Explore Cisco ISE performance, focusing on profiler events and posture authentication across platform configurations. Analyze node maximums and how different versions impact event handling in labs.

Explore Cisco ISE personas bandwidth requirements, detailing minimum bandwidth for monitoring and troubleshooting nodes, policy service nodes, and policy administration nodes, including links from primary to secondary.

Compare centralized versus distributed Cisco ISE deployment options. Centralized places all nodes in one location; distributed splits policy administration nodes, policy service nodes, and monitoring and troubleshooting nodes across locations.

Explore history of IEEE 802.1X, introduced in the late 1990s, and how it authenticates devices at layer 2 using eapol, with switch prompts and two phases: monitor and low-impact mode.

Explore IEEE 802.1X phase 1 monitor mode, which allows enabling authentication on access ports in an audit phase without denying access. It logs authentication success or failure to diagnose issues.

Demystifies the IEEE 802.1X phase 1 monitor mode flow, showing how switches learn MAC addresses, traffic begins, and access remains full whether 1X authentication succeeds or times out.

Explore the IEEE 802.1X flow on a switch port, including MAB fallback on timeout and access outcomes for successful or failed authentication in the ISE 2.1.0 deep dive labs.

Enable IEEE 802.1X phase 2 low-impact mode to permit basic services before authentication. Allow DHCP IP assignment and DNS queries so the host can function pre-auth.

Examine the ieee 802.1x phase 2 low-impact mode flow, including switch mac learning and mab authentication. Verify that successful authentication yields role-based access; unsuccessful or timed-out attempts yield limited access.

Understand IEEE 802.1X phase 2 closed mode, the default high-security setting where only EAPOL messages pass and all other traffic is denied.

Discover the IEEE 802.1x phase 2 closed mode flow as a switch drives the next authentication, granting role-based access on success and ERP overlay messages on failure.

Explore available enforcement types for the ISE 2.1.0 lab, including low impact mode and closed mode, with examples like downloadable AC, dynamic relaying, security group filter ID, and redirection.

Explore Cisco ISE security policy decision steps from device connection and security domain checks to exempt list, authentication, authorization, posture checks, quarantine, and remediation.

Explore Cisco ISE device profiling, identifying endpoint types and behavior from network access devices, with over 200 built-in profiles and more than 375 profiler conditions that drive authorization when matched.

Explore how Cisco ISE uses probes to collect data for profiling. Probes such as net flow, radius, map, snmp, and device sensors feed profiling data.

Discover how Cisco ice posture assessment checks a device's health, including antivirus status and OS patching, using web and NEC agents on Windows and Mac.

Explore Tripoli, detailing authentication, authorization, and accounting (aaa) and how authentication validates a username and password with the server to grant network access.

Shows how authorization works with the Tripoli server, mapping user profiles to allowed commands, and enforcing authentication and authorization decisions for level 1 to 3 users.

Authenticate users on a switch via the Tripoli server, authorize commands by level 1/2/3 profiles (show and debug), and record activity in an accounting database.

Explore radius and tacacs+ protocols, their ports: radius 1812/1813 or 1645/1646, tacacs+ 49; and encryption methods. Compare authentication and authorization, noting radius for network access and tacacs+ for device administration.

Learn to install Windows Server 2008 on VMware Workstation by creating a custom VM, selecting the OS, configuring hardware, completing installation, and installing VMware Tools for optimal performance.

Install Active Directory on Microsoft Server 2008 by running DC promo to create a new forest and domain, then reboot and verify with AD Sites and Services.

Install and configure certificate authority on Windows Server 2008, including Active Directory Certificate Services, Network Device Enrollment Services, and web enrollment.

Install ISE 2.0 1.0 from an ISO in a workstation, configure Red Hat Enterprise Linux 7, set hostname and IP, enable SSL, and verify services are running after installation.

Install Cisco identity services engine 2.1.0 via OVF on a VM workstation, configure ISE name, IP address, DNS, domain, and gateway, then verify application status.

Explore the Cisco identity services engine web portal, log in, create users and groups, configure identity sources, add network devices, and review basic policies and deployment steps.

Learn to join Microsoft Active Directory with ISE 2.1.0 by configuring external identity sources, adding an Active Directory with domain name, and creating an identity source sequence for policy authentication.

Explore how to configure LDAP integration and identity source sequence in Cisco Identity Services Engine (ISE) 2.1.0, including Active Directory binding, group mapping, and authentication policies.

Register ISE 2.1.0 with a self-signed certificate and configure primary and secondary deployments, then import certificates, create an admin user and identity groups, and verify synchronization.

Register and configure the identity services engine with a Microsoft certificate authority by generating a certificate signing request, exchanging certificates, and deploying primary and secondary nodes with synchronization.

Learn to back up Cisco ISE 2.1.0 via cli using an FTB server, configure basic ISE settings, set up a backup repository, and verify the completed backup.

Install patch on Cisco Identity Services Engine 2.1.0 via CLI, configure repository, back up configuration, install the patch file, and reboot to complete upgrade.

Perform a patch rollback of Cisco identity services engine 2.1.0 using the CLI, reverting the ICE patch to 2.0, uninstalling patch three, and rebooting the system.

learn to upgrade Cisco identity services engine via cli, configuring the repository, downloading the upgrade bundle, validating files, backing up configuration, and rebooting after the 2.1.0 to 2.2 upgrade.

Back up Cisco identity services engine 2.1.0 via the GUI, configure the depository, create an active directory username and groups, start the backup with encryption, and verify completion.

Restore Cisco ISE 2.1.0 via the GUI by selecting the FTP backup and encryption key. Monitor restoration progress, verify backup integrity, and confirm identity services engine status after completion.

Install Cisco identity services engine patch 2.1.0 via GUI by selecting the patch bundle in batch management, then monitor the installation, reboot, and service readiness.

Roll back patches on Cisco identity services engine 2.1.0 using the graphical user interface by navigating to administration and maintenance, selecting rollback, and verifying patch information after completion.

Upgrade Cisco identity services engine 2.1.0 through the gui by configuring the ftb server and downloading the bundle. Validate and complete the upgrade via the repository Shivah and status checks.

Configure the initial ISE lab, assign VLAN interfaces 10, 20, 30, 40, and 50 with IPs, enable ip routing, set up DNS and DHCP, and verify reachability and name resolution.

Configure MAC authentication bypass on ISE 2.1.0, set up radius servers and keys, assign IP addresses, and complete the initial configuration for verification.

Verify mac authentication bypass (mab) on a switch by testing a client pc, observing authentication failure and success, and confirming the mac address entry and live logs.

Learn to configure 802.1x with MD5 using Cisco identity services engine, including radius settings and initial switch and device configuration for authenticating hosts.

Demonstrate configuring 802.1x with MD5 in ISE 2.1.0, including enabling the MD5 registry, restarting config services, and validating authentication and network access on a test PC.

Configure dynamic VLAN assignment with Cisco ISE 2.1.0, using 802.1X and RADIUS to map usernames and groups to VLANs via policies.

Demonstrate dynamic VLAN verification with MD5 on ISE, authenticating test users and dynamically assigning VLAN 50 to interface 48, then testing connectivity via PC sessions.

Learn to configure dynamic vlan and downloadable acl with md5 on Cisco ISE 2.1.0, including radius 802.1x authentication, policy setup, and verification.

verify dynamic vlan and dynamic dacl assignment using md5 on ise 2.1.0 labs, demonstrating authentication, policy enforcement, and network access control across internal and external networks.

Configure dot1x with PEAP on ISE 2.1.0 by setting up a RADIUS server, enabling host authentication on switch port 48, and verifying reachability and successful authentication.

Navigate dot1x verification with PEAP in an ISE 2.1.0 lab, configure wired autoconfig and EAP settings, set certificates, and verify user authentication to access internal networks.

Learn to configure dot1x with PEAP and AD in ISE 2.1.0, including initial switch configuration, RADIUS server, AD integration, and policy updates for secure network access.

Demonstrate 802.1X verification with PEAP and AD using ISE 2.1.0, guiding you through login, authentication sessions, and network reachability across a 48-port switch for secure access.

Learn to configure dynamic VLAN with Cisco ISE 2.1.0 using PEAP, set up RADIUS authentication, define identity groups and policy, and validate end-to-end switch authentication.

Learn how to verify dynamic VLAN assignment for PEAP-authenticated wireless clients using ISE 2.1.0, including switch connections, authentication sessions, and IP address tracking.

Learn to configure dynamic VLAN and downloadable DACLs with PEAP using Cisco ISE 2.1.0, covering initial ISE setup, RADIUS integration, group policies, and switch authorization.

Demonstrates dynamic vlan and downloadable acl verification using PEAP in ise 2.1.0 labs, showing authentication sessions, policy-driven access, and differing internal vs internet network reach.

Configure wired local web authentication with Cisco ISE 2.1.0, setting radius server, ACLs, and policy mappings to authenticate and log wired clients.

Configure wired local web authentication verification in the ISE 2.1.0 lab by adjusting NIC properties and testing with a client via Internet Explorer.

Learn to configure wired central web authentication with Cisco ISE 2.1.0, covering initial setup, radius and ACL policies, DNS, and pre-auth and authenticated access for the CW group.

Verify wired central web authentication using radius and CWA credentials, test connections, and review live logs to validate authentication sessions in ISE.

install Cisco identity services engine (ISE) using ISO in a virtual machine, configure hostname and IP settings with DNS and SSL, then complete setup and verify via the web interface.

Learn to take a snapshot of Cisco ISE 2.2.0, monitor saving progress, configure users, groups, devices, and deploy settings, then revert to the snapshot to verify restoration.

Access the Cisco identity services engine web portal and manage users, groups, devices, deployments, certificates, and live logs.

Demonstrates joining an active directory with Cisco identity services engine, configuring external identity sources and an identity source sequence, and defining authentication policy.

Explore ldap integration with Cisco Identity Services Engine and configure an identity source sequence using Active Directory groups, administration settings, and authentication policies.

Learn how to register ISE with a self-signed certificate, export and import that certificate between ISE nodes, and establish a primary and secondary deployment with certificate trust.

Register Cisco ISE 2.2.0 with Microsoft certificate authority by configuring primary and secondary nodes, generating and signing certificate requests, importing and trusting certificates, and validating deployment synchronization.

Back up Cisco identity services engine using the CLI, configure an FTB server and repository, and apply an encryption key for secure ISE backups.

Learn how to perform a Cisco ISE restoration from a point-to-point backup via CLI, configure a Shivah repository, set credentials, and verify identities and groups post-restore.

Learn to install the Cisco identity services engine 2.2.0 patch via the CLI. Configure the patch repository, load update files, and reboot to complete the upgrade.

learn how to rollback a patch on Cisco Identity Services Engine 2.0 via the CLI by removing the ice patch application and verifying the new version after reboot.

Back up Cisco identity services engine (ISE) via GUI by configuring a backup repository, creating a user, setting an encryption key, and preparing for a restore.

Restore Cisco Identity Services Engine via GUI by reverting to a snapshot, then perform a DUI-based backup restore, verify services, reboot, and verify identity groups and deployments.

Install a patch on Cisco Identity Services Engine (ISE) via the GUI, using maintenance and patch management, browse the patch bundle, install, and verify after 10–15 minutes.

Learn how to roll back ISE 2.2.0 patches using the gui by navigating to administration maintenance patch management, selecting patches, and initiating roll back, and verify patch information after waiting.

Configure the ISE lab's initial setup by assigning switch interface IP addresses, enabling IP routing, and configuring DHCP and DNS, including domain lookup and connectivity tests.

Configure mac authentication bypass with Cisco identity services engine, setting radius server details and port 48 on the switch, then verify authentication bypass.

Verify mac authentication bypass on ISE 2.2.0 by testing with a PC, observing authentication success and failure, deleting and refreshing entries, and confirming port 48 connectivity.

Learn to configure dot1x with md5 on Cisco identity services engine to authenticate a host via radius, enable 802.1x on switch ports, and verify the lab.

Verify dot1x authentication with md5 in ISE 2.2.0 labs by configuring NIC properties and enabling user authentication, then connect a test PC to confirm access to internal resources.

Configure dynamic VLAN with MD5 on Cisco ISE 2.2.0 by defining a radius-based authentication flow, onboarding network devices, and mapping users through identity groups to VLANs via authorization policies.

Explore dynamic VLAN verification with MD5 in Cisco ISE through hands-on lab scenarios, authenticating users, applying policies, and validating network access on test PCs.

Learn to configure dynamic vlan and dacl using md5 with Cisco ISE, covering 802.1x, radius, and post-authentication policies, and verify the setup on the switch.

Verify dynamic VLAN and DACL behavior in ISE 2.1 labs by authenticating users, applying MD5 verification, and observing access control via interface 1 and IP access lists.

Verify dot1x with peap by configuring authentication, testing with a PC, and validating successful authentication on the switch and internal resources before internet access.

Learn to configure dot1x with PEAP and AD on Cisco ISE 2.0, including initial setup, AD integration, role of radius, and verifying client authentication.

practice 802.1x verification using PEAP and AD in an ISE lab, validating successful authentications, monitoring session interfaces, and troubleshooting with NIC and cable checks.

Explore configuring dynamic VLANs with PEAP using Cisco ISE 2.2.0, covering RADIUS settings, host authentication, identity groups, and authorization policies in a hands-on lab.

Verify dynamic VLAN with PEAP using ISE 2.2.0, showing authentication steps, RADIUS communication, and VLAN assignment outcomes through a lab environment.

Configure dynamic VLANs and downloadable ACLs with PEAP using Cisco ISE 2.0, linking RADIUS to switch ports, defining identity groups and policies to grant or deny network access.

Explore dynamic vlan and downloadable acl verification using peap with Cisco identity services engine, configuring authentication sessions, acls, and internet access control to validate policy enforcement.

Configure wired local web authentication using Cisco ISE 2.2.0, set up radius servers, create access lists and fallback profiles, and apply web authentication to switch interfaces for secure client access.

Demonstrate wired local web authentication verification on a switch with ISE, review authentication sessions and interface IP configuration, and confirm external resource access while internal network access is restricted.

Configure wired central web authentication with the Cisco identity services engine, setting up radius, DNS, ACLs, and policies for pre-auth wired clients.

Demonstrate wired central web authentication (CWA) verification by configuring a PC and switch, validating authentication sessions, and troubleshooting DHCP, DNS, and IP address assignment.

Complete the final segment of the CCIE Security ISE 2.1.0 deep dive labs and reinforce practical lab skills from the deep dive.