Domain 1 · 10%
SISE-300-715 · blueprint v1.2
Implementing and Configuring Cisco Identity Services Engine
CCNP Security concentration. One master lab topology, built once and added to module by module.
3/74
SISE-300-715 · Implementing and Configuring Cisco Identity Services Engine
Lesson slugs never change and lessons are never renumbered — a link you save today still resolves after a blueprint revision.
CCNP Security concentration. One master lab topology, built once and added to module by module — every lesson written for this exam, not stitched from a video library.
MODULE 1 ISE Architecture & Deployment
01 M1 · Lab 1: Power On the ISE Lab — Three ISE Nodes, Active Directory & the Admin Workstation In Production 02 Identity Management: Guest, Profiling, Posture & BYOD In Production 03 ISE Personas: PAN, MnT, PSN & pxGrid Controller — What Each Node Actually Runs In Production L2 M1 · Lab 2: ISE Personas: PAN, MnT, PSN & pxGrid Controller — What Each Node Actually Runs Lab 04 ISE Deployment Models: Standalone, Distributed, Node Groups & Dedicated MnT Live L3 M1 · Lab 3: ISE Deployment Models: Standalone, Distributed, Node Groups & Dedicated MnT Lab 05 Zero-Touch Provisioning: Image and VM User Data Bring-Up, the Config File & Automated Onboarding Live L4 M1 · Lab 4: Zero-Touch Provisioning: Image and VM User Data Bring-Up, the Config File & Automated Onboarding Lab 06 Build a Distributed Deployment: Register Nodes, Assign Personas, Verify Replication & Promote the Secondary In Production L5 M1 · Lab 5: Build a Distributed Deployment: Register Nodes, Assign Personas, Verify Replication & Promote the Secondary Lab 07 Sizing ISE: Appliance SKUs, VM Resource Profiles, Session Scale & Licence Tiers Live L6 M1 · Lab 6: Sizing ISE: Appliance SKUs, VM Resource Profiles, Session Scale & Licence Tiers Lab 01 M2 · Lab 1: Add the Identity Sources — Active Directory, LDAP & the Certificate Chain In Production 02 Identity Store Options: Internal, Active Directory, LDAP, PKI, ODBC & Multifactor — Choosing the Right One In Production 03 Join ISE to Active Directory: Join Points, Domain Controllers, Groups, Attributes & the Diagnostic Tool In Production 04 LDAP, ODBC & Internal Users: Binds, Search Bases, Attribute Retrieval & Identity Source Sequences In Production L2 M2 · Lab 2: External Identity Stores: AD Join Points, LDAP, ODBC & Identity Source Sequences · 2 scenarios Lab 05 ISE Certificates & PKI: System Certificate Roles, Trusted Store, CSRs/SANs & the ISE Internal CA In Production L3 M2 · Lab 3: ISE Certificates & PKI: System Certificate Roles, Trusted Store, CSRs/SANs & the ISE Internal CA Lab 06 Cisco Duo in Zero Trust: MFA, Device Trust & Adaptive Access Policies In Production 07 Policy Sets: Service Types, Conditions, Dictionaries, Authentication Rules & Identity Source Sequences In Production 08 Authorization Policy & Profiles: Results, Common Tasks, Advanced Attributes & Rule Evaluation Order In Production L4 M2 · Lab 4: Policy Sets & Authorization: Conditions, Authentication Rules, Profiles & Evaluation Order · 2 scenarios Lab
01 M3 · Lab 1: Bring Up the Access Layer — IOS-XE Switch, Wireless LAN Controller & the Test Endpoints In Production 02 802.1X, EAP & RADIUS Flows: Packet Walk In Production L2 M3 · Lab 2: 802.1X, EAP & RADIUS Flows: Packet Walk Lab 03 Change of Authorization: Types, Triggers, Timers & the RFC 5176 Packet Walk In Production L3 M3 · Lab 3: Change of Authorization: Types, Triggers, Timers & the RFC 5176 Packet Walk Lab 04 EAP Methods Compared: PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS, EAP-FAST & TEAP EAP Chaining In Production 05 Configure 802.1X, MAB & WebAuth with ISE In Production 06 IBNS 2.0: C3PL Identity Control Policies, Service Templates & Converting from Legacy 802.1X In Production 07 Monitor Mode, Low-Impact Mode & Closed Mode: Staging 802.1X Without Breaking the Campus In Production 08 Host Modes & MAB: Single-Host, Multi-Domain, Multi-Auth, Multi-Host — and Authenticating What Cannot Speak 802.1X In Production L4 M3 · Lab 4: 802.1X on the Campus: EAP Methods, MAB, WebAuth, IBNS 2.0, Deployment Modes & Host Modes · 5 scenarios Lab 09 Authorization: dACLs, Dynamic VLAN Assignment & CoA In Production L5 M3 · Lab 5: Authorization: dACLs, Dynamic VLAN Assignment & CoA Lab 10 Wireless 802.1X End to End: WLC AAA Server Lists, WPA2/WPA3-Enterprise, AAA Override & Wireless CoA In Production L6 M3 · Lab 6: Wireless 802.1X End to End: WLC AAA Server Lists, WPA2/WPA3-Enterprise, AAA Override & Wireless CoA Lab
01 M4 · Lab 1: Prepare the TrustSec Domain — SGT-Capable Switch, PAC Provisioning & Environment Data In Production 02 Cisco TrustSec: Classification, Propagation & Enforcement — the Three-Phase Model In Production 03 SGT Classification: Dynamic Assignment via Authorization Profile, Static IP/Subnet/VLAN Mappings & the SGT Database In Production 04 Propagating SGTs: Inline Tagging (CMD) vs SXP — Speaker/Listener Peers, the PAC Exchange & Environment Data Download In Production 05 Enforcement: SGACLs, the ISE Policy Matrix, Egress Policy Download & SGT-Based Firewall Rules In Production 06 pxGrid Context Sharing: Publishing Session and SGT Context to Subscribers In Production L2 M4 · Lab 2: TrustSec End to End: SGT Classification, SXP & Inline Tagging, SGACL Enforcement & pxGrid · 4 scenarios Lab
MODULE 5 Web Authentication & Guest Services
01 M5 · Lab 1: Stand Up the Guest Environment — Guest VLAN, DNS, Portal Certificate & the Guest SSID In Production 02 Web Authentication in ISE: Local vs Central Web Auth, the URL-Redirect Mechanic & When to Use Each In Production 03 Central Web Auth Packet Walk: MAB, Redirect, Portal Authentication & CoA Re-Authorization In Production 04 Configure Central Web Auth on Wired: Redirect ACL, MAB Policy Set, Portal Result & the CoA In Production 05 Central Web Auth on Wireless: MAC-Filtering SSIDs, AAA Override, RADIUS NAC & the Guest Anchor Pattern In Production L2 M5 · Lab 2: Central Web Auth: the Packet Walk, Wired Redirect & the Wireless Guest Anchor · 3 scenarios Lab 06 Guest Access Types: Hotspot, Self-Registered & Sponsored — Flows, Guest Types, Identity Groups & Time Profiles In Production L3 M5 · Lab 3: Guest Access Types: Hotspot, Self-Registered & Sponsored — Flows, Guest Types, Identity Groups & Time Profiles Lab 07 Build the Guest Portals: Hotspot & Self-Registered — Pages, AUP, Device Registration & Portal Certificates In Production 08 Sponsor Portal & Sponsor Groups: AD-Backed Sponsors, Account Creation, Approval Workflow & Guest Account Lifecycle In Production 09 Portal Customization: Themes, Languages, Portal FQDN & Multi-Portal Design for Multiple Guest Populations In Production L4 M5 · Lab 4: Guest Portals: Hotspot, Self-Registered, Sponsor Groups & Portal Customization · 3 scenarios Lab 10 Troubleshooting Guest & Web Auth: Redirect Failures, Certificate Warnings, DNS, CoA Drops & Reading Live Logs In Production L5 M5 · Lab 5: Troubleshooting Guest & Web Auth: Redirect Failures, Certificate Warnings, DNS, CoA Drops & Reading Live Logs Lab MODULE 6 Profiler & Endpoint Identity
01 M6 · Lab 1: Prepare Profiling — DHCP Relay, SPAN, SNMP, NetFlow Sources & the Endpoints to Profile In Production 02 How ISE Profiling Works: Attribute Dictionaries, Profiling Policies, Certainty Factors & the Endpoint Database In Production 03 Profiling Probes: RADIUS, DHCP & DHCP-SPAN, SNMPQUERY/SNMPTRAP, HTTP, DNS, NMAP, NetFlow and Active Directory In Production 04 Probe Data on the Wire: DHCP Relay, RADIUS Accounting & SNMP Query Packet Walk In Production L2 M6 · Lab 2: Profiling Probes: RADIUS, DHCP, SNMP, HTTP, DNS, NMAP, NetFlow & AD — and What They Look Like on the Wire · 2 scenarios Lab 05 Authoring Profiling Policies: Conditions, Logical Profiles, Policy Hierarchy & the Profiler Feed Service In Production L3 M6 · Lab 3: Authoring Profiling Policies: Conditions, Logical Profiles, Policy Hierarchy & the Profiler Feed Service Lab 06 Configure Profiler CoA & Re-Authorization: Global Settings, Per-Policy CoA & Wired vs Wireless Differences In Production L4 M6 · Lab 4: Configure Profiler CoA & Re-Authorization: Global Settings, Per-Policy CoA & Wired vs Wireless Differences Lab 07 Endpoint Identity Management: Identity Groups, Static Assignment, Import/Export, Context Visibility & Purge Rules In Production 08 Adaptive Network Control & pxGrid Consumption: Endpoint Quarantine, ANC Policies, MDM & Threat-Centric NAC Attributes In Production L5 M6 · Lab 5: Endpoint Identity & Adaptive Network Control: Identity Groups, Context Visibility, ANC & pxGrid · 2 scenarios Lab 09 Troubleshooting Profiling: Unknown Endpoints, Wrong Profiles, Missing Probe Data & CoA That Never Fires In Production L6 M6 · Lab 6: Troubleshooting Profiling: Unknown Endpoints, Wrong Profiles, Missing Probe Data & CoA That Never Fires Lab 01 M7 · Lab 1: Prepare BYOD — Internal CA, SCEP RA to AD CS, the Provisioning SSID & a Personal Device In Production 02 Cisco BYOD: Use Cases, Requirements & Solution Components In Production 03 The BYOD Flows: Single-SSID vs Dual-SSID Onboarding, Step by Step In Production L2 M7 · Lab 2: The BYOD Flows: Single-SSID vs Dual-SSID Onboarding, Step by Step Lab 04 Certificates for BYOD: ISE Internal CA, SCEP RA to AD CS, Certificate Templates, Key Size & EAP-TLS Trust In Production L3 M7 · Lab 3: Certificates for BYOD: ISE Internal CA, SCEP RA to AD CS, Certificate Templates, Key Size & EAP-TLS Trust Lab 05 BYOD Portals & Client Provisioning Policy: My Devices, BYOD Portal, Native Supplicant Profiles & the Wizard In Production 06 Dual-SSID Onboarding on the Wireless LAN Controller: Open Provisioning SSID to EAP-TLS Corporate SSID In Production 07 Wired BYOD: Onboarding Through the Switch with Redirect, IBNS 2.0 Service Templates & EAP-TLS In Production L4 M7 · Lab 4: BYOD Onboarding: Portals, Native Supplicant Profiles, Dual-SSID Wireless & Wired EAP-TLS · 3 scenarios Lab 08 BYOD Lifecycle Operations: My Devices Portal, Lost/Stolen, Blocklist, Reinstate, Certificate Revocation & OCSP In Production 09 MDM/UEM Integration: Registration and Compliance Attributes in Authorization Policy & Remote Device Actions In Production L5 M7 · Lab 5: BYOD Lifecycle & MDM: My Devices, Lost/Stolen, Certificate Revocation & UEM Compliance in Policy · 2 scenarios Lab 10 Troubleshooting BYOD: Wizard Failures, SCEP Errors, Certificate Chain Problems & Onboarding Loops In Production L6 M7 · Lab 6: Troubleshooting BYOD: Wizard Failures, SCEP Errors, Certificate Chain Problems & Onboarding Loops Lab
MODULE 8 Endpoint Compliance & Posture
01 M8 · Lab 1: Stage Posture — Secure Client Packages, Compliance Module & the Remediation Segment In Production 02 Endpoint Compliance & Posture Services: Agents, the Condition-Requirement-Policy Chain & Client Provisioning In Production 03 The Posture Flow: Discovery, Redirect vs Redirectless Stage-2 Discovery, Probing, Assessment & CoA In Production L2 M8 · Lab 2: The Posture Flow: Discovery, Redirect vs Redirectless Stage-2 Discovery, Probing, Assessment & CoA Lab 04 Posture Conditions & Requirements: File, Registry, Application, Anti-Malware, Disk Encryption, Patch & Compound In Production 05 Client Provisioning: Resources, Agent Configuration, Provisioning Policy & the Client Provisioning Portal In Production 06 Configure Posture Assessment & Device Compliance In Production L3 M8 · Lab 3: Posture: Conditions & Requirements, Client Provisioning & Compliance Enforcement · 3 scenarios Lab 07 The Posture Work Center: Posture Policy in One Place, Remediation Actions, Grace Periods & Reports In Production L4 M8 · Lab 4: The Posture Work Center: Posture Policy in One Place, Remediation Actions, Grace Periods & Reports Lab 01 M9 · Lab 1: Enable the Device Admin Service — Policy Service Node, TACACS+ Licensing & the Managed Devices In Production 02 AAA Protocols Compared: RADIUS vs TACACS+ — Transport, Encryption, Packet Structure & AV Pairs In Production L2 M9 · Lab 2: AAA Protocols Compared: RADIUS vs TACACS+ — Transport, Encryption, Packet Structure & AV Pairs Lab 03 Configure & Troubleshoot TACACS+ Device Administration In Production 04 Device Admin Policy Sets: Network Device Groups, Conditions, AD Group Mapping & Rule Order In Production 05 Shell Profiles: Default & Maximum Privilege, Custom Attributes & Per-Platform Behaviour on IOS-XE, WLC & FTD In Production 06 Command Authorization: Command Sets, Permit/Deny Ordering, Wildcards & Unmatched-Command Behaviour In Production 07 Accounting & Troubleshooting Device Admin: TACACS+ Live Logs, Accounting Reports, Fallback Paths & Lockout Recovery In Production L3 M9 · Lab 3: TACACS+ Device Administration: Policy Sets, Shell Profiles, Command Sets & Accounting · 5 scenarios Lab
Part of the Cisco Security Track
All-Access covers every course in the track — see pricing.
Exam Mapping
The objective namespace is separate from the course namespace — a blueprint revision cannot break a course link, and the reverse is also true.