300-425 Question 289
Select 3A network administrator is configuring a Cisco Identity Services Engine (ISE) to provide secure network access for wireless users. The administrator wants to enforce role-based access control policies based on the user's identity and the device they are using. Which of the following steps should the administrator take to achieve this in ISE?
- A
Create and configure authorization policies in ISE based on user identity and device profile.
- B
Enable the Guest Portal in ISE to authenticate wireless users automatically without credentials.
- C
Integrate ISE with the wireless LAN controller (WLC) to receive RADIUS requests for authentication.
- D
Configure profiling policies in ISE to identify devices connecting to the wireless network.
- E
Disable RADIUS CoA (Change of Authorization) to avoid dynamic policy changes for wireless users.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement role-based access control in a Cisco wireless network using ISE, the administrator must configure authorization policies that define access rights based on user identity and device type. The WLC must be integrated with ISE to relay RADIUS requests for user and device authentication. Additionally, device profiling in ISE is necessary to classify devices and apply appropriate policies. Disabling RADIUS CoA or relying solely on the Guest Portal would not meet the requirements for secure, role-based access control.
- A. Correct.
Correct: Authorization policies in ISE allow administrators to enforce role-based access control based on user identity and device profile, which is essential for secure wireless access.
- B. Incorrect.
Incorrect: The Guest Portal is used for guest user access, not for enforcing role-based access control for known users and devices.
- C. Correct.
Correct: Integrating ISE with the WLC allows the WLC to send RADIUS authentication requests to ISE, enabling user and device authentication and policy enforcement.
- D. Correct.
Correct: Profiling policies in ISE are used to classify and identify devices, which is necessary for applying device-specific access policies.
- E. Incorrect.
Incorrect: Disabling RADIUS CoA would prevent ISE from dynamically updating access policies, which is contrary to the goal of enforcing role-based access control.