Question

A network administrator is configuring an authorization policy on Cisco ISE for corporate laptops that pass 802.1X EAP-TLS authentication on wired access switches. The requirement is that authenticated laptops must be placed in the corporate data VLAN and simultaneously receive a downloadable ACL (dACL) that permits only business application traffic. Which combination must be configured in the authorization profile to meet both requirements?

Accepted Answer

Set the VLAN under Common Tasks and reference a DACL Name that maps to a downloadable ACL defined in ISE

Answer

Configure only a Security Group Tag (SGT) and rely on the switch to derive both VLAN and ACL from the tag

Answer

Define a RADIUS authentication policy that pushes the VLAN and configure the dACL as a local ACL on each switch interface

Answer

Assign a Web Authentication redirect URL along with the VLAN, since the dACL is applied automatically after redirection