A university lab building runs IBNS 2.0 on its access switches with ISE. After a student's 802.1X session succeeds, the port must receive a service template carrying a voice VLAN and a campus ACL, while a second template must take over when ISE is unreachable. Which switch configuration places these templates under IBNS 2.0 policy-map control?
Select an answer to reveal the explanation.
Short Explanation
You put the service-template action in the subscriber policy map, where each event controls what the port receives. The session-successful event is right because your template should take effect only after the student authenticates. Think of it as handing over the room key once the ID check is done.
Full Explanation
In IBNS 2.0, the subscriber policy map is the access port’s event engine: it follows the session lifecycle and runs the configured actions. Defining a policy-map type control subscriber and applying the named service template on the session-successful event makes the voice VLAN and campus ACL take effect after AAA accepts the student’s session. The policy can also provide a second template when ISE is unreachable. Applying a template on session-started fails because the port would receive policy before the student’s identity is proven. Returning the voice VLAN and ACL only through the ISE authorization profile fails the fallback requirement: when ISE cannot be reached, it cannot return those attributes for the switch to install. Configuring the template statically under each access port fails the session-dependent requirement: it is active as soon as the link comes up, rather than following the authentication result, and can remain in effect even if the session fails. Exam caveat: event names and available actions can vary slightly across IOS XE releases, so focus on the policy-map structure as well as the syntax. Practical check: on a test port, use show access-session and show policy-map type control subscriber to confirm that the template appears when the session is accepted.