A city university is piloting 802.1X on 3,000 lab and classroom ports that still serve legacy printers and badge readers, and every existing session must keep flowing for the whole eight-week trial. The ISE logs still need to show which endpoints fail authentication and which stay completely silent. Which IBNS 2.0 port mode fits this pilot?

Monitor mode is the fit because it observes authentication activity without enforcing an authorization decision that could interrupt traffic on the university’s existing ports. It allows sessions to continue while ISE records authentication results, including failed attempts and endpoints that do not respond, giving the team evidence to evaluate before enforcement. Open authentication is a common migration approach: it permits traffic while 802.1X or MAB runs, and can log outcomes for endpoints that respond. Its gap here is that a completely silent endpoint produces no authentication response to record as such, so the required visibility is not assured. Low-impact mode commonly grants limited preauthentication access through downloadable or port-based ACLs while authentication proceeds. Although useful for staged access control, applying those ACLs can change the forwarding treatment of existing sessions, so it cannot guarantee that every session keeps flowing unchanged. Closed mode with 802.1X and MAB can report failures and timeouts for silent endpoints, but it withholds access pending authorization; unauthenticated legacy devices or current sessions may therefore lose connectivity during the trial. Exam caveat: “open” describes traffic handling, not guaranteed visibility into endpoints that never initiate or answer authentication. Practical check: test representative silent printers and badge readers on a pilot port, verify ISE distinguishes timeout/no-response from authentication failure, and confirm established traffic remains uninterrupted before expanding the deployment.