Enterprise access networks rarely contain one uniform endpoint population. Managed laptops can perform strong 802.1X authentication, while phones, printers, cameras, badge readers, and embedded devices may not have a usable supplicant. Cisco ISE combines 802.1X, MAC Authentication Bypass (MAB), and profiling so the network can authenticate capable endpoints strongly, identify non-802.1X devices with additional context, and apply access policy that reflects both identity and device type.<\/p>\n
Within 802.1X, MAB, and Profiling with Cisco ISE, the current 350-701 SCOR<\/a> v2.0 blueprint includes configuring 802.1X and MAB with Cisco ISE, while the current 300-715 SISE<\/a> v1.2 blueprint goes deeper into wired and wireless 802.1X, IBNS 2.0, MAB, profiling, and policy enforcement. The design objective is not to make MAB as trusted as 802.1X. It is to create explicit fallback behavior for devices that cannot perform stronger authentication and to keep those devices visible.<\/p>\n 802.1X separates the endpoint supplicant, the authenticator at the switch or wireless infrastructure, and the authentication server represented by ISE. EAP runs between the supplicant and ISE through the network access device. This architecture lets ISE validate user, machine, or certificate identity while the access device enforces the resulting authorization. Strong methods such as EAP-TLS can provide mutual certificate-based authentication without relying on a reusable password.<\/p>\n Design the EAP method around the endpoint-management reality. A managed fleet can receive certificates and supplicant profiles centrally; an unmanaged device may not. Validate server-certificate trust and identity mapping before enforcing closed access. If users are trained to click through certificate warnings during 802.1X setup, the access design undermines the trust model it was intended to strengthen.<\/p>\n MAB identifies an endpoint by its MAC address when it cannot perform 802.1X. Because MAC addresses can be observed and spoofed, MAB alone provides much less assurance than certificate-based authentication. Use it for endpoint classes that genuinely need it, and restrict the authorization result to what that class requires. A printer may need print servers, DNS, DHCP, and management services but not broad lateral access.<\/p>\n Keep an inventory of MAB-only devices and owners. Unknown MAC addresses should not automatically land in a permissive VLAN simply because the switch timed out waiting for 802.1X. The broader dynamic access control<\/a> principle applies: weak identity should be compensated by narrower access, richer context, monitoring, and a clear exception lifecycle.<\/p>\n ISE profiling collects attributes from supported probes and network telemetry to infer endpoint type. DHCP characteristics, RADIUS data, SNMP queries, HTTP user-agent information, Cisco Discovery Protocol, LLDP, and other sources can contribute to a profile. A MAC address can say which device record is present; profiling can suggest whether that endpoint behaves like a phone, printer, workstation, camera, or another known class.<\/p>\n Profiling is probabilistic classification, not cryptographic identity. Treat a profile as a policy signal with a confidence level. A rule that grants sensitive access solely because an endpoint resembles a printer is vulnerable to imitation. Strong designs use profiling to narrow MAB authorization, detect anomalies, and drive operational visibility while reserving high-trust access for stronger authentication and device-management evidence.<\/p>\n A profiling policy is only as useful as the attributes reaching ISE. Plan which network devices can send DHCP, RADIUS, SNMP, NetFlow, or discovery information, and understand where encrypted or routed traffic hides useful signals. Verify probe configuration and attribute freshness before tuning profile rules. Otherwise, an endpoint may remain \u201cUnknown\u201d because the expected telemetry never arrived, not because the profile logic is wrong.<\/p>\n Start with broad endpoint families and refine only where a policy decision needs the distinction. Creating hundreds of highly specific profiles increases maintenance cost and can cause reclassification surprises when firmware or vendor behavior changes. For each profile used in authorization, document the key attributes, minimum certainty, expected owner, and the access outcome if the endpoint drops back to an unknown state.<\/p>\n Large wired deployments benefit from phased enforcement. Monitor mode can observe authentication behavior without blocking production. Low-impact designs can permit a limited pre-authentication set of services while identity is established. Closed mode enforces the intended access policy once endpoint coverage and exception handling are mature. The exact IBNS 2.0 policy depends on switch platform and software, so use current platform documentation for configuration syntax.<\/p>\n Measure the exception population during each phase. Identify ports with phones and computers, printers using MAB, devices that fail EAP because of certificate issues, and infrastructure that should never have been placed into a user-access policy. Phasing turns deployment into evidence collection. It gives the team time to correct identity and profile gaps before enforcement converts those gaps into outages.<\/p>\n Authorization is where ISE converts context into access. Conditions can include identity group, endpoint profile, EAP method, network device group, SSID, posture state, security group, or other attributes. For example, a domain computer authenticated with EAP-TLS on a corporate access switch can receive normal employee access, while a profiled printer using MAB receives only print and management flows.<\/p>\nUse 802.1X as the primary identity mechanism where endpoints support it<\/h3>\n
Treat MAB as a constrained exception path<\/h3>\n
Profile endpoints to add context that authentication does not provide<\/h3>\n
Build profiling policy from the probes you can actually observe<\/h3>\n
Stage wired 802.1X enforcement instead of switching directly to closed mode<\/h3>\n
Combine identity, endpoint class, and location in authorization policy<\/h3>\n