[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF8VRTFSVFCT57ZE2DZ2XH":3,"skill-same:01M6AF8VRTFSVFCT57ZE2DZ2XH":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AF8VRTFSVFCT57ZE2DZ2XH","implementing-network-access-control-with-cisco-ise",null,"Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags. Use when deploying enterprise NAC with ISE and Active Directory integration, enforcing endpoint posture compliance, or segmenting access with TrustSec instead of a generic 802.1X\u002FPacketFence setup.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-access-control-with-cisco-ise\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing network access control with cisco ise","network","cisco-ise","eap-tls","dynamic-vlan","mab","posture-assessment","network-access-control","radius","nac","802.1x","directory","tls","endpoint","server","authentication","assessment","identity","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-network-access-control-with-cisco-ise\ndescription: Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X\n  wired and wireless authentication, MAC Authentication Bypass, posture assessment,\n  dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags. Use\n  when deploying enterprise NAC with ISE and Active Directory integration, enforcing\n  endpoint posture compliance, or segmenting access with TrustSec instead of a\n  generic 802.1X\u002FPacketFence setup.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- cisco-ise\n- 802.1x\n- nac\n- radius\n- network-access-control\n- posture-assessment\n- mab\n- dynamic-vlan\n- eap-tls\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1027\n---\n\n# Implementing Network Access Control with Cisco ISE\n\n## Overview\n\nCisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.\n\n\n## When to Use\n\n- When deploying or configuring implementing network access control with cisco ise capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Cisco ISE 3.1+ appliance or virtual machine (16 CPU cores, 64GB RAM minimum for production)\n- Cisco switches with 802.1X support (Catalyst 9000 series recommended)\n- Active Directory domain with user and computer accounts\n- PKI infrastructure for EAP-TLS certificate-based authentication\n- DNS and NTP configured consistently across ISE nodes and network devices\n- Supplicant software on endpoints (Windows native, AnyConnect NAM, or SecureW2)\n\n## Core Concepts\n\n### 802.1X Architecture\n\nThe 802.1X framework involves three components:\n\n| Component | Role | Example |\n|-----------|------|---------|\n| **Supplicant** | Client requesting network access | Windows 802.1X client, AnyConnect NAM |\n| **Authenticator** | Network device controlling port access | Cisco Catalyst switch |\n| **Authentication Server** | Policy decision engine | Cisco ISE (RADIUS) |\n\n### Authentication Flow\n\n```\n1. Endpoint connects to switch port\n2. Switch sends EAP-Request\u002FIdentity to endpoint\n3. Endpoint responds with EAP-Response\u002FIdentity\n4. Switch forwards credentials to ISE via RADIUS Access-Request\n5. ISE authenticates against AD\u002FLDAP\u002Finternal store\n6. ISE evaluates authorization policy\n7. ISE returns RADIUS Access-Accept with attributes (VLAN, dACL, SGT)\n8. Switch enforces authorization on the port\n```\n\n### Authentication Methods\n\n| Method | Use Case | Security Level |\n|--------|----------|---------------|\n| EAP-TLS | Certificate-based, highest security | High |\n| PEAP-MSCHAPv2 | Username\u002Fpassword via AD | Medium |\n| EAP-FAST | Cisco proprietary, fast reauthentication | Medium |\n| MAB | Non-802.1X devices (printers, IP phones) | Low |\n\n## Workflow\n\n### Step 1: Configure ISE for Active Directory Integration\n\nNavigate to **Administration > Identity Management > External Identity Sources > Active Directory**:\n\n1. Add AD join point with domain name (e.g., `corp.example.com`)\n2. Provide domain admin credentials for ISE machine account\n3. Join ISE to the domain\n4. Select AD groups for authorization policies:\n   - `Domain Users` - Standard employee access\n   - `Domain Computers` - Machine authentication\n   - `IT-Admins` - Privileged access\n   - `BYOD-Users` - Personal device access\n\n### Step 2: Configure Network Devices in ISE\n\nNavigate to **Administration > Network Resources > Network Devices**:\n\n```\nName: SW-ACCESS-01\nIP Address: 10.0.1.1\u002F32\nRADIUS Shared Secret: C0mpl3x$3cretKey!\nSNMP Settings: v2c, community string\nDevice Type: Cisco Switches\nLocation: Building-A-Floor-1\n```\n\nCreate a Network Device Group hierarchy:\n```\nDevice Type:\n  ├── Cisco Switches\n  │   ├── Access Layer\n  │   └── Distribution Layer\n  └── Wireless Controllers\nLocation:\n  ├── Building-A\n  └── Building-B\n```\n\n### Step 3: Configure Switch for 802.1X\n\nApply this configuration to the access switch:\n\n```\n! Enable AAA\naaa new-model\naaa authentication dot1x default group radius\naaa authorization network default group radius\naaa accounting dot1x default start-stop group radius\naaa accounting update newinfo periodic 2880\n\n! Configure RADIUS server\nradius server ISE-PRIMARY\n address ipv4 10.0.5.10 auth-port 1812 acct-port 1813\n key 0 C0mpl3x$3cretKey!\n automate-tester username radius-test probe-on\n\nradius server ISE-SECONDARY\n address ipv4 10.0.5.11 auth-port 1812 acct-port 1813\n key 0 C0mpl3x$3cretKey!\n automate-tester username radius-test probe-on\n\naaa group server radius ISE-GROUP\n server name ISE-PRIMARY\n server name ISE-SECONDARY\n deadtime 15\n ip radius source-interface Loopback0\n\n! Enable 802.1X globally\ndot1x system-auth-control\n\n! Enable RADIUS CoA (Change of Authorization)\naaa server radius dynamic-author\n client 10.0.5.10 server-key C0mpl3x$3cretKey!\n client 10.0.5.11 server-key C0mpl3x$3cretKey!\n\n! Enable device tracking for IP-to-MAC mapping\ndevice-tracking tracking auto-source\n\n! Configure access port template\ninterface range GigabitEthernet1\u002F0\u002F1-48\n description 802.1X Access Port\n switchport mode access\n switchport access vlan 100\n\n ! Authentication settings\n authentication host-mode multi-auth\n authentication order dot1x mab\n authentication priority dot1x mab\n authentication port-control auto\n authentication periodic\n authentication timer reauthenticate server\n authentication timer inactivity server dynamic\n authentication violation restrict\n\n ! 802.1X settings\n dot1x pae authenticator\n dot1x timeout tx-period 10\n dot1x max-reauth-req 2\n\n ! MAB fallback\n mab\n\n ! Enable spanning-tree portfast (required for timely auth)\n spanning-tree portfast\n\n ! Apply pre-auth ACL\n ip access-group PRE-AUTH-ACL in\n\n! Pre-authentication ACL (allow DHCP, DNS, ISE portal)\nip access-list extended PRE-AUTH-ACL\n permit udp any any eq 67\n permit udp any any eq 68\n permit udp any any eq 53\n permit tcp any host 10.0.5.10 eq 8443\n permit tcp any host 10.0.5.11 eq 8443\n deny ip any any\n```\n\n### Step 4: Configure ISE Authentication Policy\n\nNavigate to **Policy > Policy Sets**:\n\n**Authentication Policy:**\n\n| Rule Name | Condition | Allowed Protocols | Identity Source |\n|-----------|-----------|-------------------|-----------------|\n| Dot1X-EAP-TLS | Radius:EAP-Type EQUALS EAP-TLS | EAP-TLS | AD with Certificate |\n| Dot1X-PEAP | Radius:EAP-Type EQUALS PEAP | PEAP-MSCHAPv2 | Active Directory |\n| MAB | Radius:Service-Type EQUALS Call-Check | MAB Lookup | Internal Endpoints |\n| Default | Default | Default | Deny Access |\n\n### Step 5: Configure ISE Authorization Policy\n\n**Authorization Policy:**\n\n| Rule Name | Condition | Authorization Profile |\n|-----------|-----------|----------------------|\n| IT-Admin-Wired | AD:Group EQUALS IT-Admins AND Dot1X | VLAN10-FullAccess |\n| Employee-Compliant | AD:Group EQUALS Domain Users AND Posture:Compliant | VLAN100-Corporate |\n| Employee-NonCompliant | AD:Group EQUALS Domain Users AND Posture:NonCompliant | VLAN200-Remediation |\n| Printer-MAB | EndpointIdentityGroup EQUALS Printers | VLAN150-Printers |\n| IP-Phone-MAB | EndpointIdentityGroup EQUALS IP-Phones | VLAN50-Voice |\n| BYOD-Onboarding | AD:Group EQUALS BYOD-Users AND !Registered | BYOD-Portal-Redirect |\n| Guest-Access | GuestEndpointGroup EQUALS GuestEndpoints | VLAN300-Guest |\n| Default | Default | DenyAccess |\n\n**Authorization Profiles:**\n\n```\nProfile: VLAN100-Corporate\n  VLAN: 100\n  dACL: PERMIT_ALL\n  SGT: Employees (0x0005)\n  Reauthentication Timer: 28800\n\nProfile: VLAN200-Remediation\n  VLAN: 200\n  dACL: REMEDIATION-ACL (allow only remediation server access)\n  Web Redirection: Posture Discovery\n  Reauthentication Timer: 300\n\nProfile: DenyAccess\n  Access Type: ACCESS_REJECT\n```\n\n### Step 6: Configure Posture Assessment\n\nNavigate to **Work Centers > Posture**:\n\n**Posture Conditions:**\n```\n- Windows Firewall Enabled (Registry check)\n- Antivirus Running and Updated (AV compound condition)\n- OS Patch Level Current (Windows Update check)\n- Disk Encryption Enabled (BitLocker check)\n```\n\n**Posture Requirements:**\n```\nRequirement: Corporate-Windows-Compliance\n  OS: Windows All\n  Conditions: Windows Firewall AND Antivirus AND OS Patches\n  Remediation: Auto-remediate with AnyConnect ISE Posture Module\n```\n\n**Posture Policy:**\n```\nRule: Windows-Endpoints\n  Identity Group: Any\n  OS: Windows All\n  Requirement: Corporate-Windows-Compliance\n```\n\n### Step 7: Configure TrustSec Segmentation\n\nEnable SGT-based segmentation:\n\n```\n! On switch - enable CTS\ncts credentials id SW-ACCESS-01 password CtsP@ss\ncts role-based enforcement\ncts role-based sgt-map 10.0.100.0\u002F24 sgt 5\n\n! Download SGT policy from ISE\ncts role-based permissions\n```\n\nISE TrustSec Matrix (SGACL):\n\n| Source SGT | Destination SGT | Policy |\n|------------|----------------|--------|\n| Employees (5) | Servers (10) | Permit_HTTP_HTTPS |\n| Employees (5) | PCI_Zone (15) | Deny_All |\n| IT-Admins (3) | Servers (10) | Permit_All |\n| Guest (7) | Internet (99) | Permit_HTTP_HTTPS |\n| Guest (7) | Servers (10) | Deny_All |\n\n## Troubleshooting\n\n```bash\n# On switch - verify authentication status\nshow authentication sessions\nshow authentication sessions interface Gi1\u002F0\u002F1 details\nshow dot1x all\n\n# Check RADIUS connectivity\ntest aaa server radius ISE-PRIMARY username testuser password testpass\n\n# On ISE - check live logs\n# Navigate to Operations > RADIUS > Live Logs\n# Filter by MAC address or username\n# Review Authentication Details for failure reason\n\n# Common failure reasons:\n# 12514 - EAP-TLS handshake failed (certificate issue)\n# 22056 - Subject not found in identity store\n# 24408 - User not found in Active Directory\n# 24454 - User password expired\n```\n\n## Best Practices\n\n- **Monitor Mode First** - Deploy in monitor mode (open authentication) before closed mode enforcement\n- **Low-Impact Mode** - Use `authentication open` with pre-auth dACLs for gradual rollout\n- **MAB Database** - Pre-populate endpoint database with known MAC addresses for printers, phones\n- **Profiling** - Enable ISE profiling to automatically classify endpoints by type\n- **CoA Support** - Ensure Change of Authorization is configured for dynamic policy updates\n- **High Availability** - Deploy ISE in a Primary\u002FSecondary node pair with PAN failover\n- **Certificate Infrastructure** - Use machine certificates for EAP-TLS for strongest authentication\n\n## References\n\n- [Cisco ISE Admin Guide 3.1](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Ftd\u002Fdocs\u002Fsecurity\u002Fise\u002F3-1\u002Fadmin_guide\u002Fb_ise_admin_3_1.html)\n- [Cisco 802.1X Design Guide](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Fsupport\u002Fdocs\u002Flan-switching\u002F8021x\u002F214843-guide-ieee-802-1x-deployment-with-cisco.html)\n- [CiscoLive ISE Deployment Guide 2025](https:\u002F\u002Fwww.ciscolive.com\u002Fc\u002Fdam\u002Fr\u002Fciscolive\u002Femea\u002Fdocs\u002F2025\u002Fpdf\u002FBRKSEC-2660.pdf)\n- [Cisco ISE Wired 802.1X Configuration](https:\u002F\u002Fwww.networkcomputing.com\u002Fnetwork-security\u002Fcisco-ise-wired-802-1x-configuration)\n","# Implementing Network Access Control with Cisco ISE\n\n## Overview\n\nCisco Identity Services Engine (ISE) provides centralized network access control through 802.1X authentication, MAC Authentication Bypass (MAB), posture assessment, and guest access management. ISE acts as a RADIUS policy server that evaluates authentication requests from network devices (switches, wireless controllers) and returns authorization policies including VLAN assignments, downloadable ACLs (dACLs), and Security Group Tags (SGTs). This skill covers deploying ISE for enterprise wired 802.1X authentication with Active Directory integration, MAB fallback, posture compliance enforcement, and TrustSec segmentation.\n\n\n## When to Use\n\n- When deploying or configuring implementing network access control with cisco ise capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Cisco ISE 3.1+ appliance or virtual machine (16 CPU cores, 64GB RAM minimum for production)\n- Cisco switches with 802.1X support (Catalyst 9000 series recommended)\n- Active Directory domain with user and computer accounts\n- PKI infrastructure for EAP-TLS certificate-based authentication\n- DNS and NTP configured consistently across ISE nodes and network devices\n- Supplicant software on endpoints (Windows native, AnyConnect NAM, or SecureW2)\n\n## Core Concepts\n\n### 802.1X Architecture\n\nThe 802.1X framework involves three components:\n\n| Component | Role | Example |\n|-----------|------|---------|\n| **Supplicant** | Client requesting network access | Windows 802.1X client, AnyConnect NAM |\n| **Authenticator** | Network device controlling port access | Cisco Catalyst switch |\n| **Authentication Server** | Policy decision engine | Cisco ISE (RADIUS) |\n\n### Authentication Flow\n\n```\n1. Endpoint connects to switch port\n2. Switch sends EAP-Request\u002FIdentity to endpoint\n3. Endpoint responds with EAP-Response\u002FIdentity\n4. Switch forwards credentials to ISE via RADIUS Access-Request\n5. ISE authenticates against AD\u002FLDAP\u002Finternal store\n6. ISE evaluates authorization policy\n7. ISE returns RADIUS Access-Accept with attributes (VLAN, dACL, SGT)\n8. Switch enforces authorization on the port\n```\n\n### Authentication Methods\n\n| Method | Use Case | Security Level |\n|--------|----------|---------------|\n| EAP-TLS | Certificate-based, highest security | High |\n| PEAP-MSCHAPv2 | Username\u002Fpassword via AD | Medium |\n| EAP-FAST | Cisco proprietary, fast reauthentication | Medium |\n| MAB | Non-802.1X devices (printers, IP phones) | Low |\n\n## Workflow\n\n### Step 1: Configure ISE for Active Directory Integration\n\nNavigate to **Administration > Identity Management > External Identity Sources > Active Directory**:\n\n1. Add AD join point with domain name (e.g., `corp.example.com`)\n2. Provide domain admin credentials for ISE machine account\n3. Join ISE to the domain\n4. Select AD groups for authorization policies:\n   - `Domain Users` - Standard employee access\n   - `Domain Computers` - Machine authentication\n   - `IT-Admins` - Privileged access\n   - `BYOD-Users` - Personal device access\n\n### Step 2: Configure Network Devices in ISE\n\nNavigate to **Administration > Network Resources > Network Devices**:\n\n```\nName: SW-ACCESS-01\nIP Address: 10.0.1.1\u002F32\nRADIUS Shared Secret: C0mpl3x$3cretKey!\nSNMP Settings: v2c, community string\nDevice Type: Cisco Switches\nLocation: Building-A-Floor-1\n```\n\nCreate a Network Device Group hierarchy:\n```\nDevice Type:\n  ├── Cisco Switches\n  │   ├── Access Layer\n  │   └── Distribution Layer\n  └── Wireless Controllers\nLocation:\n  ├── Building-A\n  └── Building-B\n```\n\n### Step 3: Configure Switch for 802.1X\n\nApply this configuration to the access switch:\n\n```\n! Enable AAA\naaa new-model\naaa authentication dot1x default group radius\naaa authorization network default group radius\naaa accounting dot1x default start-stop group radius\naaa accounting update newinfo periodic 2880\n\n! Configure RADIUS server\nradius server ISE-PRIMARY\n address ipv4 10.0.5.10 auth-port 1812 acct-port 1813\n key 0 C0mpl3x$3cretKey!\n automate-tester username radius-test probe-on\n\nradius server ISE-SECONDARY\n address ipv4 10.0.5.11 auth-port 1812 acct-port 1813\n key 0 C0mpl3x$3cretKey!\n automate-tester username radius-test probe-on\n\naaa group server radius ISE-GROUP\n server name ISE-PRIMARY\n server name ISE-SECONDARY\n deadtime 15\n ip radius source-interface Loopback0\n\n! Enable 802.1X globally\ndot1x system-auth-control\n\n! Enable RADIUS CoA (Change of Authorization)\naaa server radius dynamic-author\n client 10.0.5.10 server-key C0mpl3x$3cretKey!\n client 10.0.5.11 server-key C0mpl3x$3cretKey!\n\n! Enable device tracking for IP-to-MAC mapping\ndevice-tracking tracking auto-source\n\n! Configure access port template\ninterface range GigabitEthernet1\u002F0\u002F1-48\n description 802.1X Access Port\n switchport mode access\n switchport access vlan 100\n\n ! Authentication settings\n authentication host-mode multi-auth\n authentication order dot1x mab\n authentication priority dot1x mab\n authentication port-control auto\n authentication periodic\n authentication timer reauthenticate server\n authentication timer inactivity server dynamic\n authentication violation restrict\n\n ! 802.1X settings\n dot1x pae authenticator\n dot1x timeout tx-period 10\n dot1x max-reauth-req 2\n\n ! MAB fallback\n mab\n\n ! Enable spanning-tree portfast (required for timely auth)\n spanning-tree portfast\n\n ! Apply pre-auth ACL\n ip access-group PRE-AUTH-ACL in\n\n! Pre-authentication ACL (allow DHCP, DNS, ISE portal)\nip access-list extended PRE-AUTH-ACL\n permit udp any any eq 67\n permit udp any any eq 68\n permit udp any any eq 53\n permit tcp any host 10.0.5.10 eq 8443\n permit tcp any host 10.0.5.11 eq 8443\n deny ip any any\n```\n\n### Step 4: Configure ISE Authentication Policy\n\nNavigate to **Policy > Policy Sets**:\n\n**Authentication Policy:**\n\n| Rule Name | Condition | Allowed Protocols | Identity Source |\n|-----------|-----------|-------------------|-----------------|\n| Dot1X-EAP-TLS | Radius:EAP-Type EQUALS EAP-TLS | EAP-TLS | AD with Certificate |\n| Dot1X-PEAP | Radius:EAP-Type EQUALS PEAP | PEAP-MSCHAPv2 | Active Directory |\n| MAB | Radius:Service-Type EQUALS Call-Check | MAB Lookup | Internal Endpoints |\n| Default | Default | Default | Deny Access |\n\n### Step 5: Configure ISE Authorization Policy\n\n**Authorization Policy:**\n\n| Rule Name | Condition | Authorization Profile |\n|-----------|-----------|----------------------|\n| IT-Admin-Wired | AD:Group EQUALS IT-Admins AND Dot1X | VLAN10-FullAccess |\n| Employee-Compliant | AD:Group EQUALS Domain Users AND Posture:Compliant | VLAN100-Corporate |\n| Employee-NonCompliant | AD:Group EQUALS Domain Users AND Posture:NonCompliant | VLAN200-Remediation |\n| Printer-MAB | EndpointIdentityGroup EQUALS Printers | VLAN150-Printers |\n| IP-Phone-MAB | EndpointIdentityGroup EQUALS IP-Phones | VLAN50-Voice |\n| BYOD-Onboarding | AD:Group EQUALS BYOD-Users AND !Registered | BYOD-Portal-Redirect |\n| Guest-Access | GuestEndpointGroup EQUALS GuestEndpoints | VLAN300-Guest |\n| Default | Default | DenyAccess |\n\n**Authorization Profiles:**\n\n```\nProfile: VLAN100-Corporate\n  VLAN: 100\n  dACL: PERMIT_ALL\n  SGT: Employees (0x0005)\n  Reauthentication Timer: 28800\n\nProfile: VLAN200-Remediation\n  VLAN: 200\n  dACL: REMEDIATION-ACL (allow only remediation server access)\n  Web Redirection: Posture Discovery\n  Reauthentication Timer: 300\n\nProfile: DenyAccess\n  Access Type: ACCESS_REJECT\n```\n\n### Step 6: Configure Posture Assessment\n\nNavigate to **Work Centers > Posture**:\n\n**Posture Conditions:**\n```\n- Windows Firewall Enabled (Registry check)\n- Antivirus Running and Updated (AV compound condition)\n- OS Patch Level Current (Windows Update check)\n- Disk Encryption Enabled (BitLocker check)\n```\n\n**Posture Requirements:**\n```\nRequirement: Corporate-Windows-Compliance\n  OS: Windows All\n  Conditions: Windows Firewall AND Antivirus AND OS Patches\n  Remediation: Auto-remediate with AnyConnect ISE Posture Module\n```\n\n**Posture Policy:**\n```\nRule: Windows-Endpoints\n  Identity Group: Any\n  OS: Windows All\n  Requirement: Corporate-Windows-Compliance\n```\n\n### Step 7: Configure TrustSec Segmentation\n\nEnable SGT-based segmentation:\n\n```\n! On switch - enable CTS\ncts credentials id SW-ACCESS-01 password CtsP@ss\ncts role-based enforcement\ncts role-based sgt-map 10.0.100.0\u002F24 sgt 5\n\n! Download SGT policy from ISE\ncts role-based permissions\n```\n\nISE TrustSec Matrix (SGACL):\n\n| Source SGT | Destination SGT | Policy |\n|------------|----------------|--------|\n| Employees (5) | Servers (10) | Permit_HTTP_HTTPS |\n| Employees (5) | PCI_Zone (15) | Deny_All |\n| IT-Admins (3) | Servers (10) | Permit_All |\n| Guest (7) | Internet (99) | Permit_HTTP_HTTPS |\n| Guest (7) | Servers (10) | Deny_All |\n\n## Troubleshooting\n\n```bash\n# On switch - verify authentication status\nshow authentication sessions\nshow authentication sessions interface Gi1\u002F0\u002F1 details\nshow dot1x all\n\n# Check RADIUS connectivity\ntest aaa server radius ISE-PRIMARY username testuser password testpass\n\n# On ISE - check live logs\n# Navigate to Operations > RADIUS > Live Logs\n# Filter by MAC address or username\n# Review Authentication Details for failure reason\n\n# Common failure reasons:\n# 12514 - EAP-TLS handshake failed (certificate issue)\n# 22056 - Subject not found in identity store\n# 24408 - User not found in Active Directory\n# 24454 - User password expired\n```\n\n## Best Practices\n\n- **Monitor Mode First** - Deploy in monitor mode (open authentication) before closed mode enforcement\n- **Low-Impact Mode** - Use `authentication open` with pre-auth dACLs for gradual rollout\n- **MAB Database** - Pre-populate endpoint database with known MAC addresses for printers, phones\n- **Profiling** - Enable ISE profiling to automatically classify endpoints by type\n- **CoA Support** - Ensure Change of Authorization is configured for dynamic policy updates\n- **High Availability** - Deploy ISE in a Primary\u002FSecondary node pair with PAN failover\n- **Certificate Infrastructure** - Use machine certificates for EAP-TLS for strongest authentication\n\n## References\n\n- [Cisco ISE Admin Guide 3.1](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Ftd\u002Fdocs\u002Fsecurity\u002Fise\u002F3-1\u002Fadmin_guide\u002Fb_ise_admin_3_1.html)\n- [Cisco 802.1X Design Guide](https:\u002F\u002Fwww.cisco.com\u002Fc\u002Fen\u002Fus\u002Fsupport\u002Fdocs\u002Flan-switching\u002F8021x\u002F214843-guide-ieee-802-1x-deployment-with-cisco.html)\n- [CiscoLive ISE Deployment Guide 2025](https:\u002F\u002Fwww.ciscolive.com\u002Fc\u002Fdam\u002Fr\u002Fciscolive\u002Femea\u002Fdocs\u002F2025\u002Fpdf\u002FBRKSEC-2660.pdf)\n- [Cisco ISE Wired 802.1X Configuration](https:\u002F\u002Fwww.networkcomputing.com\u002Fnetwork-security\u002Fcisco-ise-wired-802-1x-configuration)\n",{"name":5,"tags":49,"author":50,"domain":42,"license":15,"version":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58},[26,34,33,32,31,30,29,28,27],"mahipal","1.0",[53,54,55,56],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","network-security",[59,60,61,62,63],"T1046","T1040","T1557","T1071","T1027","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-network-access-control-with-cisco-ise",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-network-access-control-with-cisco-ise",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-network-access-control-with-cisco-ise",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-network-access-control-with-cisco-ise","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-access-control-with-cisco-ise\u002FSKILL.md",true,[88,93,97,103],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-access-control-with-cisco-ise\u002FLICENSE",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE.txt",10174,"https:\u002F\u002Fgithub.com\u002Fjleechanorg\u002Fjleechan-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ffrontend-design\u002FLICENSE.txt",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1603,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-access-control-with-cisco-ise\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",4832,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-network-access-control-with-cisco-ise\u002Fscripts\u002Fagent.py",[110,135,159,187,213,240],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[116],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,119,120,121,43,42,122,41,123,124,125,126,127,128,129,130,131,132,133,134],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,131,144,145,43,146,42,123,147,148,149,150,151,152,153,154,155,156,157,158],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":169,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[165,168],{"categoryNo":166,"categoryName":167,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,170,171,172,173,42,174,175,147,176,177,178,179,180,181,182,183,184,185,186],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,42,198,199,200,201,202,203,204,205,206,207,208,209,150,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,223,42,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":241,"name":242,"nameZh":6,"description":243,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":244,"categories":245,"keywords":247,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[246],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[43,248,42,249,250,251,252,253,254,255,256,182,257,183,258,259,260,261,262,263],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]