Cisco ISE - Diff bet EasyConnect visibility mode and enforcement mode

[muthumohan]

Hello All,

I understand how EasyConnect works in general, but I am unable to fully understand the difference between Cisco ISE EasyConnect visibility mode and Enforcement mode.

As per Cisco SISE training,

For Visibility mode;

Authentication method is set to Easyconnect visibility and source is identity mapping-RADIUS

For Enforcement mode;

Authentication method is set to External Web Authentication (EWA) and source is identity mapping-RADIUS

I am not sure what the above two sentences mean. Any clarification on what these modes mean would be appreciated.

thank you,

Mohan

[ericsmi]

In EasyConnect Visibility Mode, we are just collecting the information about the session via AD and RADIUS-MAB. After the user has logged in there is no COA sent back to the NAD.

In EasyConnect Enforcement mode we will now pass a policy down to the NAD after ISE gets notified from AD and RADIUS-MAB about the login. ISE will use a COA to NAD and will pass a policy to the NAD for enforcement.

Eric Smith

CCSI