A customer with Cisco ISE deployed wants logged-in Active Directory user names to appear in FMC connection events and to work as conditions in access-control rules. The ISE pxGrid service is already enabled, and the team argues about which device takes which pxGrid role. Which statement correctly assigns the publisher, subscriber and controller roles in this design?
Select an answer to reveal the explanation.
Short Explanation
pxGrid works like a noticeboard where one node posts topics and others sign up to read them. Here ISE is the controller and the identity publisher, while your Management Center joins as a subscriber that requests those sessions. The Management Center receives identity data through pxGrid; FTD appliances do not connect to ISE as pxGrid clients for this design.
Full Explanation
pxGrid is a client-based exchange managed by a controller: nodes authenticate to the controller, advertise the topics they publish, and subscribe to the topics they need. In this design ISE is both the controller and the publisher of identity context, holding the user and device sessions it learns from authentication. The Management Center joins that grid as a client node and subscribes to the session topic, so user names land in the FMC where connection events and rule conditions can use them; the Management Center then delivers that identity context to managed devices rather than those devices acting as grid clients themselves. Casting the Management Center as controller and publisher reverses the direction of the flow, since it does not originate identity data, and running a controller on both sides duplicates a role the design gives to one device. Practical check: on ISE, confirm the subscribed client list shows the Management Center, then verify a user session appears in an FMC connection event.