Preventing Security Shelfware: Practical Enablement for Cisco ISE Profiling and Posture Assessment

Enterprise investments in Cisco Identity Services Engine (ISE) and Network Access Control (NAC) frequently stall in passive deployments. Organisations purchase advanced profiling and posture licenses but remain indefinitely in monitor mode out of concern that active enforcement will disrupt operational workflows. Transitioning from passive visibility to zero trust enforcement requires a phased, deterministic deployment model: Monitor Mode, Low-Impact Mode, and Closed Mode.

Moving systematically through structured gates ensures security policies are enforced without causing unintended endpoint lockouts.

Phase 1: Monitor Mode Architecture and Visibility Baseline

The initial phase establishes total visibility across access switchports and wireless controllers without altering endpoint connectivity.

Switchport Configuration for Monitor Mode

Configure the access switchport macro using open authentication:

interface GigabitEthernet1/0/1
 description Access Port - Monitor Mode
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 
 # Authentication and authorisation parameters
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 authentication open
 authentication periodic
 authentication timer reauthenticate 3600
 
 # 802.1X parameters
 dot1x pae authenticator
 dot1x timeout tx-period 5
 dot1x max-req 3
 
 # Spanning tree and security safeguards
 spanning-tree portfast
 spanning-tree bpduguard enable

The directive authentication open is the core parameter of Monitor Mode: the switch allows all ingress traffic onto the configured data and voice VLANs even if RADIUS authentication or authorization fails.

Enabling ISE Endpoint Profiling Probes

To classify unmanaged hardware (printers, IoT devices, IP phones, building management systems), configure access switches to feed profiling data to ISE Policy Service Nodes (PSNs):

# Enable Device Sensor for CDP, LLDP, and DHCP snooping
device-sensor accounting
device-sensor notify all-changes

# Forward DHCP snooping information to ISE RADIUS accounting
ip dhcp snooping
ip dhcp snooping vlan 10,20

On Cisco ISE, enable matching probes:

• RADIUS Accounting Probe: Collects Framed-IP, Calling-Station-ID, and Audit-Session-ID.
• DHCP Probe: Inspects DHCP Option 55 (Parameter Request List) and Option 60 (Vendor Class Identifier).
• Device Sensor Probe: Parses LLDP system description and CDP platform strings.

Phase 2: Low-Impact Mode and Controlled Ingress

Once 95% or more of network endpoints are profiled and classified into appropriate endpoint identity groups, remove authentication open and transition to Low-Impact Mode.

In Low-Impact Mode, unauthenticated endpoints receive strictly limited network access (sufficient only to acquire DHCP, perform DNS lookups, and communicate with security remediation servers).

Ingress Pre-Authentication Port ACL (PACL)

Define the pre-authentication ACL on the access switch:

ip access-list extended PREAUTH_PORT_ACL
 # Permit essential bootstrap protocols
 permit udp any eq bootpc any eq bootps
 permit udp any any eq domain
 permit tcp any any eq domain
 
 # Permit remediation and portal redirection to ISE PSN nodes
 permit tcp any host 10.0.0.100 eq 8443
 permit tcp any host 10.0.0.101 eq 8443
 
 # Permit NTP for certificate validation
 permit udp any any eq ntp
 
 # Deny all other internal and external traffic prior to authentication
 deny ip any any

Apply the ACL to the access interface:

interface GigabitEthernet1/0/1
 no authentication open
 ip access-group PREAUTH_PORT_ACL in

When an endpoint connects, it cannot transmit packets to the enterprise network until RADIUS returns an Access-Accept with an authorization profile containing a dynamic downloadable ACL (dACL) that replaces the pre-authentication ACL.

Phase 3: Closed Mode and Posture Assessment

In Closed Mode, no packets are permitted across the physical port prior to successful authentication, with the sole exception of EAPoL (EAP over LAN) frames.

interface GigabitEthernet1/0/1
 no ip access-group PREAUTH_PORT_ACL in
 switchport mode access
 switchport access vlan 10
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 dot1x pae authenticator

Posture Assessment Workflow

When an authorized corporate laptop connects, ISE evaluates its compliance state before granting full network access:

[Endpoint Connects] ──► [EAP-TLS Machine/User Auth] ──► [RADIUS Access-Accept: Quarantine dACL]
                                                                  │
                                                                  ▼
                                                      [Cisco Secure Client Scans Host]
                                                      - Antivirus signatures
                                                      - Disk encryption (BitLocker)
                                                      - OS security patches
                                                                  │
                                                                  ▼
[Full Access Granted (dACL/SGT)] ◄── [CoA Reauthenticate] ◄── [ISE Posture: Compliant]

Sample ISE Downloadable ACLs (dACLs)

Quarantine / Remediation dACL (DACL_POSTURE_REMEDIATION):

permit udp any eq bootpc any eq bootps
permit udp any any eq domain
permit tcp any any eq domain
permit tcp any host 10.0.0.100 eq 8443
permit tcp any host 10.0.0.101 eq 8443
permit tcp any host 10.100.1.50 eq 80
permit tcp any host 10.100.1.50 eq 443
deny ip any any

Corporate Full Access dACL (DACL_CORP_COMPLIANT):

permit ip any any

When the posture module in Cisco Secure Client verifies that BitLocker encryption is active and required software patches are installed, it signals compliance to the ISE PSN. ISE sends a RADIUS Change of Authorization (CoA) message (coa-reauth) to the switch, dynamically pushing DACL_CORP_COMPLIANT.

Operational Transition Gate Criteria

Progressing between phases must follow verified operational metrics:

Following these phased operational gates prevents shelfware and transforms passive monitoring into resilient zero-trust access control.