Question

A network engineer is deploying IBNS 2.0 on Cisco Catalyst switches integrated with ISE. During the pilot, management requires that all endpoints (including devices failing 802.1X) retain basic network connectivity for DHCP, DNS, and access to the remediation server, while authenticated devices receive full access. Unauthenticated traffic must still be filtered. Which host mode and deployment approach on the switchport best meets these requirements?

Accepted Answer

Configure Low-Impact mode using 'authentication open' with a pre-authentication port ACL that permits DHCP, DNS, and remediation server traffic, then applies a dACL on success

Answer

Configure Closed mode with 'authentication open' disabled so that no traffic passes before authentication succeeds

Answer

Configure Monitor mode so that all authentication results are logged but no access control is enforced on any endpoint

Answer

Configure multi-host mode so that the first authenticated device opens the port for all subsequent endpoints on that port