SecurityLessons Reserve founders spot

Lesson-to-lab structure

SISE-300-715 Labs

74 planned lessons collapse into 42 planned labs (0 built so far) across 66 scenarios, numbered per module in the order you meet them: each lab follows the last lesson it exercises.

42labs planned
66scenarios
12multi-scenario
30single-scenario

How a lab is put together

Scenario 1 establishes the foundation. Every later scenario depends on Scenario 1 and, wherever possible, on nothing else — hub-and-spoke rather than a chain. A failure in Scenario 3 does not strand Scenario 4, you can start at any scenario from one known state, and each lab needs one start-config rather than one per scenario.

Each module opens with a setup lab that brings its appliances up from the start-config — numbered like every other lab, first in its module. Labs are numbered per module, the way lessons are: M4 · Lab 2 is the second lab of Module 4. Every lab sits right after the last lesson it exercises, so you do a lesson or a few, then the lab.

Labs are grouped by module and exam objective; a grouping is refined lesson by lesson as each lab guide publishes, and the numbering never changes once a lab is live.

  1. M1 · Lab 1 Power On the ISE Lab — Three ISE Nodes, Active Directory & the Admin Workstation sise-architecture-deployment Objective setup · Set up
    1. S1 M1 · Lab 1: Power On the ISE Lab — Three ISE Nodes, Active Directory & the Admin Workstation lab-setup
  2. M1 · Lab 2 ISE Personas: PAN, MnT, PSN & pxGrid Controller — What Each Node Actually Runs sise-architecture-deployment Objective 1.1 · Configure
    1. S1 ISE Personas: PAN, MnT, PSN & pxGrid Controller — What Each Node Actually Runs configuration
  3. M1 · Lab 3 ISE Deployment Models: Standalone, Distributed, Node Groups & Dedicated MnT sise-architecture-deployment Objective 1.2 · Describe
    1. S1 ISE Deployment Models: Standalone, Distributed, Node Groups & Dedicated MnT design
  4. M1 · Lab 4 Zero-Touch Provisioning: Image and VM User Data Bring-Up, the Config File & Automated Onboarding sise-architecture-deployment Objective 1.4 · Describe
    1. S1 Zero-Touch Provisioning: Image and VM User Data Bring-Up, the Config File & Automated Onboarding concept
  5. M1 · Lab 5 Build a Distributed Deployment: Register Nodes, Assign Personas, Verify Replication & Promote the Secondary sise-architecture-deployment Objective 1.1 · Configure
    1. S1 Build a Distributed Deployment: Register Nodes, Assign Personas, Verify Replication & Promote the Secondary configuration
  6. M1 · Lab 6 Sizing ISE: Appliance SKUs, VM Resource Profiles, Session Scale & Licence Tiers sise-architecture-deployment Objective 1.3 · Describe
    1. S1 Sizing ISE: Appliance SKUs, VM Resource Profiles, Session Scale & Licence Tiers design
  7. M2 · Lab 1 Add the Identity Sources — Active Directory, LDAP & the Certificate Chain sise-identity-policy Objective setup · Set up
    1. S1 M2 · Lab 1: Add the Identity Sources — Active Directory, LDAP & the Certificate Chain lab-setup
  8. M2 · Lab 2 External Identity Stores: AD Join Points, LDAP, ODBC & Identity Source Sequences sise-identity-policy Objective 2.1 · Configure
    1. S1 Join ISE to Active Directory: Join Points, Domain Controllers, Groups, Attributes & the Diagnostic Tool configuration
    2. S2 LDAP, ODBC & Internal Users: Binds, Search Bases, Attribute Retrieval & Identity Source Sequences configuration
  9. M2 · Lab 3 ISE Certificates & PKI: System Certificate Roles, Trusted Store, CSRs/SANs & the ISE Internal CA sise-identity-policy Objective 2.2 · Describe
    1. S1 ISE Certificates & PKI: System Certificate Roles, Trusted Store, CSRs/SANs & the ISE Internal CA configuration
  10. M2 · Lab 4 Policy Sets & Authorization: Conditions, Authentication Rules, Profiles & Evaluation Order sise-identity-policy Objective 2.7 · Configure
    1. S1 Policy Sets: Service Types, Conditions, Dictionaries, Authentication Rules & Identity Source Sequences configuration
    2. S2 Authorization Policy & Profiles: Results, Common Tasks, Advanced Attributes & Rule Evaluation Order configuration
  11. M3 · Lab 1 Bring Up the Access Layer — IOS-XE Switch, Wireless LAN Controller & the Test Endpoints sise-network-access Objective setup · Set up
    1. S1 M3 · Lab 1: Bring Up the Access Layer — IOS-XE Switch, Wireless LAN Controller & the Test Endpoints lab-setup
  12. M3 · Lab 2 802.1X, EAP & RADIUS Flows: Packet Walk sise-network-access Objective 2.4 · Configure
    1. S1 802.1X, EAP & RADIUS Flows: Packet Walk protocol
  13. M3 · Lab 3 Change of Authorization: Types, Triggers, Timers & the RFC 5176 Packet Walk sise-network-access Objective 4.3 · Implement
    1. S1 Change of Authorization: Types, Triggers, Timers & the RFC 5176 Packet Walk protocol
  14. M3 · Lab 4 802.1X on the Campus: EAP Methods, MAB, WebAuth, IBNS 2.0, Deployment Modes & Host Modes sise-network-access Objective 2.4 · Configure
    1. S1 EAP Methods Compared: PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS, EAP-FAST & TEAP EAP Chaining protocol
    2. S2 Configure 802.1X, MAB & WebAuth with ISE configuration
    3. S3 IBNS 2.0: C3PL Identity Control Policies, Service Templates & Converting from Legacy 802.1X configuration
    4. S4 Monitor Mode, Low-Impact Mode & Closed Mode: Staging 802.1X Without Breaking the Campus configuration
    5. S5 Host Modes & MAB: Single-Host, Multi-Domain, Multi-Auth, Multi-Host — and Authenticating What Cannot Speak 802.1X configuration
  15. M3 · Lab 5 Authorization: dACLs, Dynamic VLAN Assignment & CoA sise-network-access Objective 2.7 · Configure
    1. S1 Authorization: dACLs, Dynamic VLAN Assignment & CoA configuration
  16. M3 · Lab 6 Wireless 802.1X End to End: WLC AAA Server Lists, WPA2/WPA3-Enterprise, AAA Override & Wireless CoA sise-network-access Objective 2.3 · Configure
    1. S1 Wireless 802.1X End to End: WLC AAA Server Lists, WPA2/WPA3-Enterprise, AAA Override & Wireless CoA configuration
  17. M4 · Lab 1 Prepare the TrustSec Domain — SGT-Capable Switch, PAC Provisioning & Environment Data sise-trustsec Objective setup · Set up
    1. S1 M4 · Lab 1: Prepare the TrustSec Domain — SGT-Capable Switch, PAC Provisioning & Environment Data lab-setup
  18. M4 · Lab 2 TrustSec End to End: SGT Classification, SXP & Inline Tagging, SGACL Enforcement & pxGrid sise-trustsec Objective 2.6 · Configure
    1. S1 SGT Classification: Dynamic Assignment via Authorization Profile, Static IP/Subnet/VLAN Mappings & the SGT Database configuration
    2. S2 Propagating SGTs: Inline Tagging (CMD) vs SXP — Speaker/Listener Peers, the PAC Exchange & Environment Data Download protocol
    3. S3 Enforcement: SGACLs, the ISE Policy Matrix, Egress Policy Download & SGT-Based Firewall Rules configuration
    4. S4 pxGrid Context Sharing: Publishing Session and SGT Context to Subscribers protocol
  19. M5 · Lab 1 Stand Up the Guest Environment — Guest VLAN, DNS, Portal Certificate & the Guest SSID sise-webauth-guest Objective setup · Set up
    1. S1 M5 · Lab 1: Stand Up the Guest Environment — Guest VLAN, DNS, Portal Certificate & the Guest SSID lab-setup
  20. M5 · Lab 2 Central Web Auth: the Packet Walk, Wired Redirect & the Wireless Guest Anchor sise-webauth-guest Objective 3.1 · Configure
    1. S1 Central Web Auth Packet Walk: MAB, Redirect, Portal Authentication & CoA Re-Authorization protocol
    2. S2 Configure Central Web Auth on Wired: Redirect ACL, MAB Policy Set, Portal Result & the CoA configuration
    3. S3 Central Web Auth on Wireless: MAC-Filtering SSIDs, AAA Override, RADIUS NAC & the Guest Anchor Pattern configuration
  21. M5 · Lab 3 Guest Access Types: Hotspot, Self-Registered & Sponsored — Flows, Guest Types, Identity Groups & Time Profiles sise-webauth-guest Objective 3.2 · Configure
    1. S1 Guest Access Types: Hotspot, Self-Registered & Sponsored — Flows, Guest Types, Identity Groups & Time Profiles concept
  22. M5 · Lab 4 Guest Portals: Hotspot, Self-Registered, Sponsor Groups & Portal Customization sise-webauth-guest Objective 3.3 · Configure
    1. S1 Build the Guest Portals: Hotspot & Self-Registered — Pages, AUP, Device Registration & Portal Certificates configuration
    2. S2 Sponsor Portal & Sponsor Groups: AD-Backed Sponsors, Account Creation, Approval Workflow & Guest Account Lifecycle configuration
    3. S3 Portal Customization: Themes, Languages, Portal FQDN & Multi-Portal Design for Multiple Guest Populations configuration
  23. M5 · Lab 5 Troubleshooting Guest & Web Auth: Redirect Failures, Certificate Warnings, DNS, CoA Drops & Reading Live Logs sise-webauth-guest Objective 3.1 · Configure
    1. S1 Troubleshooting Guest & Web Auth: Redirect Failures, Certificate Warnings, DNS, CoA Drops & Reading Live Logs troubleshooting
  24. M6 · Lab 1 Prepare Profiling — DHCP Relay, SPAN, SNMP, NetFlow Sources & the Endpoints to Profile sise-profiler Objective setup · Set up
    1. S1 M6 · Lab 1: Prepare Profiling — DHCP Relay, SPAN, SNMP, NetFlow Sources & the Endpoints to Profile lab-setup
  25. M6 · Lab 2 Profiling Probes: RADIUS, DHCP, SNMP, HTTP, DNS, NMAP, NetFlow & AD — and What They Look Like on the Wire sise-profiler Objective 4.2 · Implement
    1. S1 Profiling Probes: RADIUS, DHCP & DHCP-SPAN, SNMPQUERY/SNMPTRAP, HTTP, DNS, NMAP, NetFlow and Active Directory configuration
    2. S2 Probe Data on the Wire: DHCP Relay, RADIUS Accounting & SNMP Query Packet Walk protocol
  26. M6 · Lab 3 Authoring Profiling Policies: Conditions, Logical Profiles, Policy Hierarchy & the Profiler Feed Service sise-profiler Objective 4.1 · Implement
    1. S1 Authoring Profiling Policies: Conditions, Logical Profiles, Policy Hierarchy & the Profiler Feed Service configuration
  27. M6 · Lab 4 Configure Profiler CoA & Re-Authorization: Global Settings, Per-Policy CoA & Wired vs Wireless Differences sise-profiler Objective 4.3 · Implement
    1. S1 Configure Profiler CoA & Re-Authorization: Global Settings, Per-Policy CoA & Wired vs Wireless Differences configuration
  28. M6 · Lab 5 Endpoint Identity & Adaptive Network Control: Identity Groups, Context Visibility, ANC & pxGrid sise-profiler Objective 4.4 · Configure
    1. S1 Endpoint Identity Management: Identity Groups, Static Assignment, Import/Export, Context Visibility & Purge Rules configuration
    2. S2 Adaptive Network Control & pxGrid Consumption: Endpoint Quarantine, ANC Policies, MDM & Threat-Centric NAC Attributes configuration
  29. M6 · Lab 6 Troubleshooting Profiling: Unknown Endpoints, Wrong Profiles, Missing Probe Data & CoA That Never Fires sise-profiler Objective 4.1 · Implement
    1. S1 Troubleshooting Profiling: Unknown Endpoints, Wrong Profiles, Missing Probe Data & CoA That Never Fires troubleshooting
  30. M7 · Lab 1 Prepare BYOD — Internal CA, SCEP RA to AD CS, the Provisioning SSID & a Personal Device sise-byod Objective setup · Set up
    1. S1 M7 · Lab 1: Prepare BYOD — Internal CA, SCEP RA to AD CS, the Provisioning SSID & a Personal Device lab-setup
  31. M7 · Lab 2 The BYOD Flows: Single-SSID vs Dual-SSID Onboarding, Step by Step sise-byod Objective 5.1 · Describe
    1. S1 The BYOD Flows: Single-SSID vs Dual-SSID Onboarding, Step by Step protocol
  32. M7 · Lab 3 Certificates for BYOD: ISE Internal CA, SCEP RA to AD CS, Certificate Templates, Key Size & EAP-TLS Trust sise-byod Objective 5.3 · Configure
    1. S1 Certificates for BYOD: ISE Internal CA, SCEP RA to AD CS, Certificate Templates, Key Size & EAP-TLS Trust configuration
  33. M7 · Lab 4 BYOD Onboarding: Portals, Native Supplicant Profiles, Dual-SSID Wireless & Wired EAP-TLS sise-byod Objective 5.2 · Configure
    1. S1 BYOD Portals & Client Provisioning Policy: My Devices, BYOD Portal, Native Supplicant Profiles & the Wizard configuration
    2. S2 Dual-SSID Onboarding on the Wireless LAN Controller: Open Provisioning SSID to EAP-TLS Corporate SSID configuration
    3. S3 Wired BYOD: Onboarding Through the Switch with Redirect, IBNS 2.0 Service Templates & EAP-TLS configuration
  34. M7 · Lab 5 BYOD Lifecycle & MDM: My Devices, Lost/Stolen, Certificate Revocation & UEM Compliance in Policy sise-byod Objective 5.4 · Implement
    1. S1 BYOD Lifecycle Operations: My Devices Portal, Lost/Stolen, Blocklist, Reinstate, Certificate Revocation & OCSP configuration
    2. S2 MDM/UEM Integration: Registration and Compliance Attributes in Authorization Policy & Remote Device Actions configuration
  35. M7 · Lab 6 Troubleshooting BYOD: Wizard Failures, SCEP Errors, Certificate Chain Problems & Onboarding Loops sise-byod Objective 5.2 · Configure
    1. S1 Troubleshooting BYOD: Wizard Failures, SCEP Errors, Certificate Chain Problems & Onboarding Loops troubleshooting
  36. M8 · Lab 1 Stage Posture — Secure Client Packages, Compliance Module & the Remediation Segment sise-posture Objective setup · Set up
    1. S1 M8 · Lab 1: Stage Posture — Secure Client Packages, Compliance Module & the Remediation Segment lab-setup
  37. M8 · Lab 2 The Posture Flow: Discovery, Redirect vs Redirectless Stage-2 Discovery, Probing, Assessment & CoA sise-posture Objective 6.1 · Describe
    1. S1 The Posture Flow: Discovery, Redirect vs Redirectless Stage-2 Discovery, Probing, Assessment & CoA protocol
  38. M8 · Lab 3 Posture: Conditions & Requirements, Client Provisioning & Compliance Enforcement sise-posture Objective 6.2 · Configure
    1. S1 Posture Conditions & Requirements: File, Registry, Application, Anti-Malware, Disk Encryption, Patch & Compound configuration
    2. S2 Client Provisioning: Resources, Agent Configuration, Provisioning Policy & the Client Provisioning Portal configuration
    3. S3 Configure Posture Assessment & Device Compliance configuration
  39. M8 · Lab 4 The Posture Work Center: Posture Policy in One Place, Remediation Actions, Grace Periods & Reports sise-posture Objective 6.3 · Configure
    1. S1 The Posture Work Center: Posture Policy in One Place, Remediation Actions, Grace Periods & Reports configuration
  40. M9 · Lab 1 Enable the Device Admin Service — Policy Service Node, TACACS+ Licensing & the Managed Devices sise-device-admin Objective setup · Set up
    1. S1 M9 · Lab 1: Enable the Device Admin Service — Policy Service Node, TACACS+ Licensing & the Managed Devices lab-setup
  41. M9 · Lab 2 AAA Protocols Compared: RADIUS vs TACACS+ — Transport, Encryption, Packet Structure & AV Pairs sise-device-admin Objective 7.1 · Describe
    1. S1 AAA Protocols Compared: RADIUS vs TACACS+ — Transport, Encryption, Packet Structure & AV Pairs protocol
  42. M9 · Lab 3 TACACS+ Device Administration: Policy Sets, Shell Profiles, Command Sets & Accounting sise-device-admin Objective 7.2 · Configure
    1. S1 Configure & Troubleshoot TACACS+ Device Administration configuration
    2. S2 Device Admin Policy Sets: Network Device Groups, Conditions, AD Group Mapping & Rule Order configuration
    3. S3 Shell Profiles: Default & Maximum Privilege, Custom Attributes & Per-Platform Behaviour on IOS-XE, WLC & FTD configuration
    4. S4 Command Authorization: Command Sets, Permit/Deny Ordering, Wildcards & Unmatched-Command Behaviour configuration
    5. S5 Accounting & Troubleshooting Device Admin: TACACS+ Live Logs, Accounting Reports, Fallback Paths & Lockout Recovery troubleshooting