Cisco ISE: Advanced Use Cases for Network Access Control

Cisco Identity Services Engine (ISE) is one of the most powerful platforms in the enterprise security toolkit. Most engineers start with the basics: 802.1X authentication, basic MAB (MAC Authentication Bypass), and simple RADIUS policies. But Cisco ISE is capable of far more. Once you understand the foundational concepts, a whole range of advanced use cases opens up that can dramatically improve your security posture in complex environments.

This post explores several advanced use cases for network access control using Cisco ISE, along with practical context for how and when to apply them.

TrustSec and Security Group Tags (SGTs)

One of the most impactful advanced use cases is Cisco TrustSec, which uses Security Group Tags to enforce access policies based on identity rather than IP address. Instead of writing ACLs based on subnets, you assign users or devices to security groups and then define which groups can talk to which other groups using Security Group ACLs (SGACLs).

This simplifies policy management significantly. A contractor laptop gets tagged with SGT 10 and a finance server gets tagged with SGT 50. You then define that SGT 10 cannot reach SGT 50, regardless of IP address or VLAN. The enforcement happens on the network fabric, not on ISE itself.

To verify SGT assignments on a switch, use:

show cts role-based sgt-map all detail

This outputs each IP-to-SGT mapping and the source of the assignment (ISE, static, or learned).

Profiling and Posture Assessment

ISE can automatically identify the type of device connecting to your network using its profiling engine. It collects attributes from DHCP, RADIUS, HTTP, SNMP, and other sources, then classifies the endpoint. An IP phone gets a different profile than a Windows workstation, and your policy can respond accordingly without any manual intervention.

Posture assessment goes a step further. ISE checks whether a device meets your security requirements before granting full access. Common checks include:

• AV status: Is antivirus installed and up to date?
• OS patch level: Is the operating system patched to a minimum version?
• Disk encryption: Is the drive encrypted?
• File presence: Does a specific compliance file exist on the device?

Devices that fail posture checks are redirected to a remediation VLAN or given limited access until they comply. This is configured using Authorization Profiles with a redirect ACL and a redirect URL pointing to the ISE Posture portal.

Guest Lifecycle Management

ISE includes a full guest access workflow that goes well beyond a simple captive portal. You can configure sponsored guest access, where an internal employee approves and creates a guest account. The guest receives credentials via email or SMS, logs in through the ISE web portal, and is assigned a policy with defined access hours, bandwidth limits, and expiration.

Guest portals are fully customizable with your organization's branding. You can even configure self-registration portals where guests sign up without sponsor involvement, useful in hospitality or conference environments.

pxGrid and Third-Party Integration

Cisco ISE uses pxGrid (Platform Exchange Grid) to share context with other security tools. Your SIEM, firewall, or threat detection platform can subscribe to ISE events and receive real-time identity context. For example, when a Cisco Stealthwatch (now Secure Network Analytics) alert fires for a suspicious endpoint, it can query ISE via pxGrid to find out who is logged in at that IP and trigger a quarantine policy automatically.

This kind of integration turns ISE into a central identity broker across your security ecosystem, not just a RADIUS server.

TACACS+ for Device Administration

ISE also handles device administration through TACACS+, which is a separate function from network access control but equally important. With TACACS+, ISE controls which commands a network engineer can run on a router or switch, logs every command executed, and enforces role-based access for your infrastructure team.

A basic TACACS+ authorization check on a Cisco device looks like:

aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local

This tells the device to ask ISE for authorization before allowing privileged exec access and any level 15 commands.

What's Next

Now that you have a picture of what ISE can do beyond the basics, the logical next step is understanding how to structure your Policy Sets to support these use cases cleanly. In the next post, we will walk through ISE Policy Set design, including how to organize authentication and authorization rules to handle multiple use cases in one deployment without creating a tangled mess of policies.