Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Implementing Network Access Control with Cisco ISE · mukul975 | DecimalAI

Implementing Network Access Control With Cisco Ise

SkillScore50Maintained

implementing-network-access-control-with-cisco-ise

Deploy Cisco Identity Services Engine for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, and dynamic VLAN assignment for network access control.

DevOpsby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-network-access-control-with-cisco-ise/SKILL.md

decimalai skills pull implementing-network-access-control-with-cisco-ise --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-network-access-control-with-cisco-ise/SKILL.md https://app.decimal.ai/s/implementing-network-access-control-with-cisco-ise/SKILL.md

Raw file: /s/implementing-network-access-control-with-cisco-ise/SKILL.md ↗ · machine-readable summary at /s/implementing-network-access-control-with-cisco-ise.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 54d ago

Yes — +36% lift · at higher cost+87% tokens0% turns50% of whole cases pass with skill (11/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-17	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-06	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-network-access-control-with-cisco-ise/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Implementing Network Access Control with Cisco ISE

Overview

Cisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.

When to Use

When deploying or configuring implementing network access control with cisco ise capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Cisco ISE 3.1+ appliance or virtual machine (16 CPU cores, 64GB RAM minimum for production)
Cisco switches with 802.1X support (Catalyst 9000 series recommended)
Active Directory domain with user and computer accounts
PKI infrastructure for EAP-TLS certificate-based authentication
DNS and NTP configured consistently across ISE nodes and network devices
Supplicant software on endpoints (Windows native, AnyConnect NAM, or SecureW2)

Core Concepts

802.1X Architecture

The 802.1X framework involves three components:

| Component | Role | Example | |-----------|------|---------| | Supplicant | Client requesting network access | Windows 802.1X client, AnyConnect NAM | | Authenticator | Network device controlling port access | Cisco Catalyst switch | | Authentication Server | Policy decision engine | Cisco ISE (RADIUS) |

Authentication Flow

1. Endpoint connects to switch port
2. Switch sends EAP-Request/Identity to endpoint
3. Endpoint responds with EAP-Response/Identity
4. Switch forwards credentials to ISE via RADIUS Access-Request
5. ISE authenticates against AD/LDAP/internal store
6. ISE evaluates authorization policy
7. ISE returns RADIUS Access-Accept with attributes (VLAN, dACL, SGT)
8. Switch enforces authorization on the port

Authentication Methods

| Method | Use Case | Security Level | |--------|----------|---------------| | EAP-TLS | Certificate-based, highest security | High | | PEAP-MSCHAPv2 | Username/password via AD | Medium | | EAP-FAST | Cisco proprietary, fast reauthentication | Medium | | MAB | Non-802.1X devices (printers, IP phones) | Low |

Workflow

Step 1: Configure ISE for Active Directory Integration

Navigate to Administration > Identity Management > External Identity Sources > Active Directory:

Add AD join point with domain name (e.g., corp.example.com)
Provide domain admin credentials for ISE machine account
Join ISE to the domain
Select AD groups for authorization policies:

Domain Users - Standard employee access
Domain Computers - Machine authentication
IT-Admins - Privileged access
BYOD-Users - Personal device access

Step 2: Configure Network Devices in ISE

Navigate to Administration > Network Resources > Network Devices:

Name: SW-ACCESS-01
IP Address: 10.0.1.1/32
RADIUS Shared Secret: C0mpl3x$3cretKey!
SNMP Settings: v2c, community string
Device Type: Cisco Switches
Location: Building-A-Floor-1

Create a Network Device Group hierarchy:

Device Type:
  ├── Cisco Switches
  │   ├── Access Layer
  │   └── Distribution Layer
  └── Wireless Controllers
Location:
  ├── Building-A
  └── Building-B

Step 3: Configure Switch for 802.1X

Apply this configuration to the access switch:

! Enable AAA
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
aaa accounting update newinfo periodic 2880

! Configure RADIUS server
radius server ISE-PRIMARY
 address ipv4 10.0.5.10 auth-port 1812 acct-port 1813
 key 0 C0mpl3x$3cretKey!
 automate-tester username radius-test probe-on

radius server ISE-SECONDARY
 address ipv4 10.0.5.11 auth-port 1812 acct-port 1813
 key 0 C0mpl3x$3cretKey!
 automate-tester username radius-test probe-on

aaa group server radius ISE-GROUP
 server name ISE-PRIMARY
 server name ISE-SECONDARY
 deadtime 15
 ip radius source-interface Loopback0

! Enable 802.1X globally
dot1x system-auth-control

! Enable RADIUS CoA (Change of Authorization)
aaa server radius dynamic-author
 client 10.0.5.10 server-key C0mpl3x$3cretKey!
 client 10.0.5.11 server-key C0mpl3x$3cretKey!

! Enable device tracking for IP-to-MAC mapping
device-tracking tracking auto-source

! Configure access port template
interface range GigabitEthernet1/0/1-48
 description 802.1X Access Port
 switchport mode access
 switchport access vlan 100

 ! Authentication settings
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 authentication timer inactivity server dynamic
 authentication violation restrict

 ! 802.1X settings
 dot1x pae authenticator
 dot1x timeout tx-period 10
 dot1x max-reauth-req 2

 ! MAB fallback
 mab

 ! Enable spanning-tree portfast (required for timely auth)
 spanning-tree portfast

 ! Apply pre-auth ACL
 ip access-group PRE-AUTH-ACL in

! Pre-authentication ACL (allow DHCP, DNS, ISE portal)
ip access-list extended PRE-AUTH-ACL
 permit udp any any eq 67
 permit udp any any eq 68
 permit udp any any eq 53
 permit tcp any host 10.0.5.10 eq 8443
 permit tcp any host 10.0.5.11 eq 8443
 deny ip any any

Step 4: Configure ISE Authentication Policy

Navigate to Policy > Policy Sets:

Authentication Policy:

| Rule Name | Condition | Allowed Protocols | Identity Source | |-----------|-----------|-------------------|-----------------| | Dot1X-EAP-TLS | Radius:EAP-Type EQUALS EAP-TLS | EAP-TLS | AD with Certificate | | Dot1X-PEAP | Radius:EAP-Type EQUALS PEAP | PEAP-MSCHAPv2 | Active Directory | | MAB | Radius:Service-Type EQUALS Call-Check | MAB Lookup | Internal Endpoints | | Default | Default | Default | Deny Access |

Step 5: Configure ISE Authorization Policy

Authorization Policy:

| Rule Name | Condition | Authorization Profile | |-----------|-----------|----------------------| | IT-Admin-Wired | AD:Group EQUALS IT-Admins AND Dot1X | VLAN10-FullAccess | | Employee-Compliant | AD:Group EQUALS Domain Users AND Posture:Compliant | VLAN100-Corporate | | Employee-NonCompliant | AD:Group EQUALS Domain Users AND Posture:NonCompliant | VLAN200-Remediation | | Printer-MAB | EndpointIdentityGroup EQUALS Printers | VLAN150-Printers | | IP-Phone-MAB | EndpointIdentityGroup EQUALS IP-Phones | VLAN50-Voice | | BYOD-Onboarding | AD:Group EQUALS BYOD-Users AND !Registered | BYOD-Portal-Redirect | | Guest-Access | GuestEndpointGroup EQUALS GuestEndpoints | VLAN300-Guest | | Default | Default | DenyAccess |

Authorization Profiles:

Profile: VLAN100-Corporate
  VLAN: 100
  dACL: PERMIT_ALL
  SGT: Employees (0x0005)
  Reauthentication Timer: 28800

Profile: VLAN200-Remediation
  VLAN: 200
  dACL: REMEDIATION-ACL (allow only remediation server access)
  Web Redirection: Posture Discovery
  Reauthentication Timer: 300

Profile: DenyAccess
  Access Type: ACCESS_REJECT

Step 6: Configure Posture Assessment

Navigate to Work Centers > Posture:

Posture Conditions:

- Windows Firewall Enabled (Registry check)
- Antivirus Running and Updated (AV compound condition)
- OS Patch Level Current (Windows Update check)
- Disk Encryption Enabled (BitLocker check)

Posture Requirements:

Requirement: Corporate-Windows-Compliance
  OS: Windows All
  Conditions: Windows Firewall AND Antivirus AND OS Patches
  Remediation: Auto-remediate with AnyConnect ISE Posture Module

Posture Policy:

Rule: Windows-Endpoints
  Identity Group: Any
  OS: Windows All
  Requirement: Corporate-Windows-Compliance

Step 7: Configure TrustSec Segmentation

Enable SGT-based segmentation:

! On switch - enable CTS
cts credentials id SW-ACCESS-01 password CtsP@ss
cts role-based enforcement
cts role-based sgt-map 10.0.100.0/24 sgt 5

! Download SGT policy from ISE
cts role-based permissions

ISE TrustSec Matrix (SGACL):

| Source SGT | Destination SGT | Policy | |------------|----------------|--------| | Employees (5) | Servers (10) | Permit_HTTP_HTTPS | | Employees (5) | PCI_Zone (15) | Deny_All | | IT-Admins (3) | Servers (10) | Permit_All | | Guest (7) | Internet (99) | Permit_HTTP_HTTPS | | Guest (7) | Servers (10) | Deny_All |

Troubleshooting

bash
# On switch - verify authentication status
show authentication sessions
show authentication sessions interface Gi1/0/1 details
show dot1x all

# Check RADIUS connectivity
test aaa server radius ISE-PRIMARY username testuser password testpass

# On ISE - check live logs
# Navigate to Operations > RADIUS > Live Logs
# Filter by MAC address or username
# Review Authentication Details for failure reason

# Common failure reasons:
# 12514 - EAP-TLS handshake failed (certificate issue)
# 22056 - Subject not found in identity store
# 24408 - User not found in Active Directory
# 24454 - User password expired

Best Practices

Monitor Mode First - Deploy in monitor mode (open authentication) before closed mode enforcement
Low-Impact Mode - Use authentication open with pre-auth dACLs for gradual rollout
MAB Database - Pre-populate endpoint database with known MAC addresses for printers, phones
Profiling - Enable ISE profiling to automatically classify endpoints by type
CoA Support - Ensure Change of Authorization is configured for dynamic policy updates
High Availability - Deploy ISE in a Primary/Secondary node pair with PAN failover
Certificate Infrastructure - Use machine certificates for EAP-TLS for strongest authentication

References

Illustrative Want to see what implementing-network-access-control-with-cisco-ise would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/30/2026, 07:20 UTC · 22 cases

Lift

+36%

50% vs 14%

Agent turns

1.0 vs 1.0

Tokens

+87%

4,774.82 vs 2,549.64

fail → pass · 8pass → pass · 3fail → fail · 11

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-14 What specific host checks and conditions must be evaluated in Cisco ISE posture assessment for corporate Windows endpoints, and what module handles auto-remediation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 What are the minimal CPU core and RAM hardware resource requirements for deploying a production Cisco ISE node in an enterprise environment?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 We are designing the Cisco ISE Authorization Policy rules for printers, IP phones, BYOD users, and guests. Outline the exact conditions and assigned profiles for each rule.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 We are implementing TrustSec SGT-based hardware enforcement across our campus. Detail the Security Group Access Control List permissions matrix between Employees (SGT 5), IT-Admins (SGT 3), Guest (SGT 7), Servers (SGT 10), PCI Zone (SGT 15), and Internet (SGT 99).	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 When configuring Catalyst switch access ports for multi-device support behind a single port (such as a PC bridged through an IP phone), which specific host-mode setting must be applied under the interface?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our enterprise requires defining network authorization outcomes in Cisco ISE for different employee health posture and identity states. Please construct a structured summary table or list detailing the authorization profile properties, including assigned VLAN IDs, dACLs, Security Group Tags, and reauthentication timers, for corporate endpoints, non-compliant devices, and blocked access.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Define the rule table mapping for a Cisco ISE Authentication Policy covering certificate-based dot1x, password-based dot1x, MAB, and default fallback. Specify the condition, protocol, and identity source for each.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We need to set up a standalone Cisco Catalyst 9300 switch stack using StackWise-480 cabling and configure hardware stacking priorities. Provide the step-by-step switch commands to renumber stack members and set priority values.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When creating a pre-authentication extended ACL on a Catalyst switch for ISE onboarded endpoints, which dynamic port numbers and protocols must be explicitly permitted before denying all other IP traffic?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Write the Cisco IOS global configuration commands required to enable dynamic RADIUS Change of Authorization (CoA) on a Catalyst switch for primary ISE IP 10.0.5.10 and secondary ISE IP 10.0.5.11.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What Cisco IOS commands are required on an access switch to enable Cisco TrustSec role-based enforcement, configure node credentials, and map a subnet 10.0.100.0/24 to SGT 5?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are experiencing authorization failures during our wired NAC rollout on Cisco Catalyst switches. Please write a diagnostic guide for Tier 2 network operators that details the switch CLI commands used to verify port authentication status and AAA server reachability, alongside common ISE live log failure codes and their root causes. Structure your guide with clear headings for Switch Diagnostic Commands, RADIUS Verification, and ISE Error Code Resolution.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Where in the Cisco ISE administrative GUI should an engineer navigate to inspect real-time RADIUS authentication attempts and filter by device MAC address?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are deploying 802.1X across our enterprise access switches and need to standardize our Catalyst switch baseline setup. Please generate a Cisco IOS CLI configuration snippet that provisions AAA, defines primary and secondary RADIUS server definitions with automated probes, sets up dynamic CoA, and configures an access switch interface range for dual 802.1X/MAB authentication with portfast and a pre-authentication extended ACL. Format the response as a clear, copy-pasteable switch configuration block followed by brief explanations of each logical section.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 We need to configure global RADIUS accounting and server group parameters on a Cisco switch for ISE. What specific periodic accounting update frequency and server deadtime interval should be configured?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 On a Cisco switch port configured for 802.1X and MAB, what maximum dot1x re-authentication request count and tx-period timer value should be applied to prevent client timeout issues?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are establishing eBGP peering between our enterprise border router (Cisco ISR 4451) and two Internet Service Providers. Provide the Cisco IOS XE router configuration commands for BGP neighbor setup and prefix filtering.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When introducing 802.1X NAC onto an existing switch network without blocking users initially, which rollout mode and configuration flag should be deployed first?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We are populating network device entries in Cisco ISE for our campus infrastructure. Define the exact network device group hierarchy structure and attributes needed for a Catalyst access switch named SW-ACCESS-01 at 10.0.1.1.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We are configuring an ASA 5585-X firewall to provide IPsec Remote Access VPN services using local database authentication. Provide the Cisco ASA CLI commands required to set up the VPN tunnel group, IP address pool, and IPsec transform set.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are connecting Cisco ISE to our enterprise Active Directory domain corp.example.com. Specify the required Active Directory groups to retrieve for mapping to authorization rules across employee, computer, administrative, and personal device access.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-19 How should Cisco ISE nodes be deployed to ensure high availability for authentication and administration services in a resilient enterprise architecture?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +36 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13.6%
Pass rate with the skill: 50%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/30/2026, 07:20 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run50

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+65% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 53 days ago

Other measured skills in the registry, with their headline benchmark lift.