A 600-user hospital group needs user-based access rules in Secure Firewall Threat Defense. Staff authenticate with domain credentials through 802.1X on wired and wireless networks and Cisco ISE records each session, so usernames must attach to their addresses promptly as people move between wards. Which identity source should supply the user-to-IP mapping?
Select an answer to reveal the explanation.
Short Explanation
Because your staff already authenticate through 802.1X, ISE can provide user-to-IP mappings from those sessions as they move between wards. You can use the ISE/ISE-PIC identity source to deliver those mappings to Secure Firewall Threat Defense. Think of ISE as a mailroom forwarding each updated badge record to the guard desk.
Full Explanation
The ISE/ISE-PIC identity source is the best fit because ISE already records your staff’s wired and wireless 802.1X sessions and can supply their session-derived user-to-IP mappings to Secure Firewall Threat Defense. This uses existing session data rather than requiring staff to authenticate again, and supports timely updates as they move between wards. Passive authentication through an Active Directory agent can map domain logons to client IPs, but those logon events are not the same as ISE’s 802.1X session data and may not promptly reflect a change in network attachment. Captive-portal authentication can bind credentials to an address, but it relies on a web authentication flow instead of the existing 802.1X session records. Cisco TS Agent reports identities for users sharing terminal-services hosts; it does not address the staff endpoint IPs involved in this wired and wireless scenario. Exam caveat: having 802.1X sessions recorded in ISE does not by itself confirm that the identity source is configured and delivering mappings to the firewall. Practical check: inspect ISE for a test user’s active session and current IP, then verify that the corresponding user-to-IP mapping appears promptly in Secure Firewall Threat Defense.