802.1x implementation on ISE

[Rafael Jimenez]

Hello,

I have a question. Can I implement a NAC with ISE without configure 802.1x ?.

It's ISE agentless or anyconnect is mandatory?

Thanks.

[Rob Ingram]

Hi,
Yes you could implement NAC with ISE and not use 802.1x, either using MAB or PassiveID to authenticate the devices. However 802.1x is considered more secure than MAB or PassiveID.

You do not necessarily need AnyConnect, you'd only really use AnyConnect NAM if you want to use EAP-FAST to combine computer and user authentication. If you use MAB/PassiveID then no agent on the client computer is required.

HTH

[Rafael Jimenez]

Hello RJI,

I need a NAC solution that works with Cisco, Aruba and Juniper (switches, APs, Routers).

I want implement Monitor Mode/Low-Impact Mode those devices? 

Thanks.

[Rob Ingram · Accepted solution]

Ok well any solution will be a compromise if you need to support multiple vendors. You can create authorization rules in ISE based on the type of switch the user/computer is connecting from and return the syntax of the ACL specific to that manufacturer to be applied to the user session.

Yes, I believe you should be able to apply monitor mode on all 3 manufacturer switches. You should confirm this is HP/Aruba and Juniper forums, as this forum specialises in Cisco solutions.

HTH