The Policy Service Node (PSN) is the workhorse of the ISE deployment. It receives the posture assessment results from the posture agent, evaluates them against the configured authorization policies, and sends the final authorization decision (Accept, Reject, or other) to the network access device (NAD). The PAN is for configuration and administration, the MnT is for logging and reports, and ‘ISE Personas Admin Node’ is not a standard ISE component.

Cisco ISE assigns specific UseCase attributes to sessions based on the flow. The ‘Employee’ UseCase is typically for corporate-owned device authentication (like 802.1X). For a BYOD registration flow, the UseCase is set to ‘BYOD’. Therefore, an authorization rule looking for ‘Employee’ will not match a device coming through the BYOD onboarding process, causing it to fall through to a default rule like ‘Quarantine’.

To enforce a hard maximum, you must configure the ‘Maximum Account Duration’ setting in ISE (Deployment > Guest Access > Settings > Guest Lifecycle). This setting acts as a ceiling; even if a sponsor tries to create an account for 24 hours, ISE will cap it at the configured maximum (8 hours). Setting just the default duration or using ‘expire after first login’ does not prevent a sponsor from setting a longer duration. A sponsor group policy can control defaults but does not inherently set a global maximum.

A core principle of Cisco TrustSec is that the source SGT (assigned at the point of access) is carried within the packet (inline or via SGT Exchange Protocol – SXP) throughout the network. Destination-based IP-to-SGT mappings are used to assign an SGT to *destination* resources that cannot authenticate natively (like servers), for use in policy lookup. They do not change the SGT in the packet header from the source. The policy engine uses the *source* SGT from the packet and the *destination* SGT (from mapping or authentication) to make an allow/deny decision.

Cisco regularly releases Device Pack updates for ISE. These updates contain new and updated profiling policies, probes, and rules for recognizing the latest devices (including IoT models) based on their observed behavior (DHCP, HTTP, CDP, etc.). Installing the latest Device Pack is the most efficient and scalable way to improve profiling accuracy across the board. Manually assigning profiles is not scalable. Increasing SNMP polling or enabling HTTP probing broadly can increase load but won’t provide new intelligence without updated profiling logic.

In modern ISE deployments, the recommended practice for external pxGrid clients (like threat platforms) is to connect to the pxGrid Director. The pxGrid Director provides a single, virtualized FQDN for the entire ISE cluster, handling client connections and intelligently distributing subscriptions and publications across all available PSNs. This provides inherent load balancing and high availability without requiring the client to manage connections to multiple individual nodes.

Cisco TrustSec policies are enforced using Security Group ACLs (SGACLs). An SGACL is a matrix-based policy that defines permit/deny actions between source and destination SGTs. Creating an SGACL with a permit rule from source SGT 30 to destination SGT 40, and a default deny, is the native and scalable method to enforce this policy. dACLs and named ACLs are IP-based and less scalable. The AuthZ policy matches sessions and assigns SGTs/Profiles, but does not define the traffic permissions between SGTs.

MAC Authentication Bypass (MAB) is the standard solution for this scenario. When 802.1X times out (because the device doesn’t respond to EAPOL frames), the switch can fall back to MAB. The switch sends the device’s MAC address to ISE as the username and password. ISE can then match this against a pre-configured list of MAC addresses and assign a limited authorization profile (like placing the printer in a restricted VLAN). This keeps the port operational while maintaining some level of access control.

While attributes like Calling-Station-ID (MAC) or User-Name can identify a user, the Acct-Session-ID is the unique identifier for a specific active session on the NAD (Network Access Device). When ISE sends a CoA request (especially a Session Termination or Reauth request), it includes the Acct-Session-ID that it originally received from the NAD in the accounting Start message. This allows the NAD to pinpoint the exact session to modify or terminate, which is crucial in environments where a user could have multiple sessions.

The Policy Service Node (PSN) is the workhorse of the ISE deployment. It receives the posture assessment results from the posture agent, evaluates them against the configured authorization policies, and sends the final authorization decision (Accept, Reject, or other) to the network access device (NAD). The PAN is for configuration and administration, the MnT is for logging and reports, and ‘ISE Personas Admin Node’ is not a standard ISE component.0