Question

A security engineer is deploying Cisco ISE posture assessment for corporate laptops. Employees authenticate successfully via 802.1X, but the engineer notices that noncompliant endpoints are still receiving full network access before posture results are evaluated. What is the correct design approach so that endpoints are restricted until posture completes?

Accepted Answer

Assign an initial authorization result with a limited-access dACL/redirect for posture, then use CoA to apply a compliant authorization profile once posture succeeds

Answer

Configure MAB as the primary authentication method so posture runs before 802.1X grants access

Answer

Enable the hotspot guest portal to force posture evaluation prior to authentication

Answer

Disable CoA on the switch so the endpoint keeps its original session until posture finishes