A retail chain wants its access control rules on the Secure Firewall Management Center to allow people by name using live context from Cisco ISE, including Security Group Tags. ISE already owns the session directory, and the integration runs over pxGrid. Which publisher and subscriber roles should each product take so the Management Center receives that live identity context?
Select an answer to reveal the explanation.
Short Explanation
Think of pxGrid as a live news feed: ISE publishes session and Security Group Tag (SGT) updates, and your Management Center subscribes to receive them. That gives you identity context for named-user access rules because ISE owns the session directory.
Full Explanation
The correct approach matches both the source of truth and the direction of the pxGrid exchange: ISE owns the session directory, so it publishes live session and SGT context, and the Management Center subscribes to receive that context for identity-based access rules. Having the Management Center publish its learned user-to-IP mappings reverses the roles and treats the Management Center as the directory owner, contrary to the scenario. Having ISE publish sessions while the Management Center assigns SGTs with its own rules would provide live user identity but not ISE’s live SGT context; local assignment is not equivalent to receiving those tags from ISE. Having ISE publish live session and SGT topics while the Management Center uses static SGT mappings also fails to use the live ISE tag context, even though the session feed is current. Exam caveat: pxGrid publisher and subscriber roles are defined per data topic, so do not infer that a product must have the same role for every integration topic. Practical check: verify the pxGrid connection and topic subscriptions in ISE, then confirm that the Management Center is receiving current user, IP, and SGT data.