Guide
What Does Cisco ISE Actually Do? The Identity Engine Explained
Identity Services Engine is the policy decision point of a Cisco network — the system that decides who and what gets access, to how much, and in what state, while switches and controllers enforce the answer.
Cisco Identity Services Engine (ISE) is the policy decision point of a Cisco network: the server that evaluates the network-access requests its network devices send it — this user, this device, this switch port, this VPN session — against policy and returns an authorization for the network to apply. Switches, wireless controllers, and VPN headends ask the question and carry out the answer; ISE makes the decision. Most of what the product adds exists to make that decision better informed.
The Decision Engine
The foundation is RADIUS. When something connects, the network access device sends ISE a request carrying whatever evidence the connection produced: an 802.1X authentication, a MAC address for MAB when an endpoint cannot or does not complete 802.1X, or, for people without accounts in the corporate directory, a web login — relayed over RADIUS by the device in local web authentication, or, in the central design built around ISE’s own portals, a MAB request that ISE answers with a portal redirect, the credentials reaching ISE directly from the user’s browser. ISE runs the evidence through its policy sets and answers with more than a yes or no — an accept can assign a VLAN, reference a downloadable ACL, or tag the session with a Security Group Tag, so the same physical port ends up granting different access to a laptop, a camera, and a contractor’s phone. That division of labor is the architecture in one line: ISE decides, the network enforces.
What Feeds the Decision
Identity comes first. ISE validates credentials against identity stores — Active Directory and LDAP, its own internal database, certificates from a PKI — and multifactor authentication can participate in the flow.
Then context. Profiling classifies what each endpoint is — printer, camera, phone, workstation — from observed and, where probes are configured, actively collected attributes: DHCP options, MAC OUI, HTTP user agents, SNMP data, CDP and LLDP details relayed by network devices. The classification becomes a policy condition, so the camera VLAN need not depend on someone hand-cataloguing cameras. Posture assessment asks a different question — not what the device is but whether it is healthy: anti-malware present, patches applied, firewall enabled — and the resulting compliance status is likewise usable in authorization policy.
Deciding Twice: Change of Authorization
The authentication exchange ends at the accept, but the session — and RADIUS’s role in it — does not: where accounting is configured, the device keeps reporting the session in start, interim, and stop records, and RADIUS dynamic authorization lets ISE reach back in. Change of Authorization (CoA) is that mechanism, acting on a session ISE already admitted: when profiling reclassifies a device, posture turns noncompliant, or an administrator quarantines an endpoint, ISE — where its policy is configured to — sends the network device a CoA message, and the device applies a new authorization or triggers a reauthentication where it supports and accepts it. Without CoA, a policy change would generally wait for the next reauthentication or session restart.
Beyond Network Access
Two further roles round out the product. For device administration, ISE speaks TACACS+: who may log in to routers, switches, and firewalls, which commands they may run, and — where command accounting is configured — a trail of what they ran — a service separate from network access, with its own domain on the exam. For people and devices outside the directory, guest services provide hotspot, self-registered, and sponsored portals, turning visitor Wi-Fi into a governed workflow; BYOD onboarding does the equivalent for employee-owned devices, provisioning certificates from an internal CA so a personal phone can authenticate with a certificate instead of a shared password.
Through Cisco TrustSec, ISE also manages group-based segmentation: policy written between Security Group Tags rather than IP addresses, with ISE holding the policy matrix and enforcement devices retrieving the group-based ACLs they need.
Built to Scale by Splitting Roles
One node can run everything in a lab, and a small production deployment can colocate personas on a redundant pair. Larger deployments split them — Policy Administration for configuration, Monitoring and Troubleshooting for logging, Policy Service Nodes for the live authentication load, pxGrid for sharing session context with integrated platforms — and the deployment personas guide walks through the models. The central Policy Service question is how many nodes should answer requests, and where, to reduce failure domains and keep capacity ahead of load.
ISE earns its own certification: the SISE 300-715 blueprint maps almost one-to-one onto this article, with Architecture and Deployment, Policy Enforcement, Web Auth and Guest Services, Profiler, BYOD, Endpoint Compliance, and Network Access Device Administration as its seven domains — each taught hands-on in the SISE 300-715 course. The skill set is genuinely cross-domain: a deployment touches switching, wireless, 802.1X, certificates, directories, and endpoint management, and a policy mistake can keep a workforce off the network. If the identity specialty appeals — being the engineer who decides who gets on the network — start with the free lesson.
Frequently Asked Questions
Is Cisco ISE just a RADIUS server?
RADIUS is its foundation, but the product is the policy evaluated behind the protocol. ISE layers device profiling, posture assessment, guest and BYOD workflows, TACACS+ device administration, and TrustSec policy management on top of the RADIUS exchange — the exchange delivers the decision; the surrounding services are what make the decision informed.
What are ISE personas?
Personas are the roles an ISE node can run: Policy Administration for configuration, Monitoring and Troubleshooting for logging and reporting, Policy Service for answering the live RADIUS and TACACS+ load, and pxGrid for exchanging session and context data with integrated platforms. A small deployment combines personas on one or two nodes; larger deployments dedicate nodes per persona so request processing scales independently of administration and logging.
Which Cisco exam covers ISE?
SISE 300-715, Implementing and Configuring Cisco Identity Services Engine — the CCNP Security concentration exam built around ISE. Its seven domains cover architecture and deployment, policy enforcement, web authentication and guest services, profiling, BYOD, endpoint compliance, and TACACS+ device administration. ISE also appears in the SCOR 350-701 core blueprint, which names it in its 802.1X and MAB objective.