MAB required with Passive Identity for Identity Exchange Only ?

[mulatif]

Hi,

I have a customer, whose only use-case for ISE-PIC is sending Identity information to Stealthwatch. In this case,

1. I assume that MAB will Not be required on the switch ?  And ISE can provide the session information received from AD connector to pxGrid subscribers.

OR

2. If it is required then what would be reason behind it ?

Thanks,

Naman

[howon · Accepted solution]

Combining MAB with passive ID for AD is generally called Easy Connect and it has two modes. Monitor mode where you simply make ISE learn username - IP mappings from the AD for context sharing purpose. And second mode where it can enforce based on passive identity which requires MAB. For ISE-PIC, only context sharing is supported.