A warehouse added 120 barcode scanners with no 802.1X supplicant, while existing laptops must still authenticate with EAP-TLS. The access template also requires ISE to profile each scanner before it receives a restricted profile. Which port authentication sequence supports this design?
Select an answer to reveal the explanation.
Short Explanation
Your switch should try 802.1X first for laptops, like checking a badge before using a backup guest list. If a scanner doesn’t respond, the switch can fall back to MAB and send its MAC address to ISE for profiling and restricted access; applying that access may require a policy update or CoA.
Full Explanation
Trying 802.1X first and using MAB only when a device does not respond supports both endpoint types: laptops can authenticate with EAP-TLS, while scanners without supplicants can proceed through MAB. ISE can then profile the scanners and apply their restricted profile only after identification, as the template requires. MAB-first is a deployed sequencing choice for environments that prioritize MAC-based onboarding, but it can let a known laptop gain access by MAC before it performs the required EAP-TLS authentication. The 802.1X-then-MAB design with a static MAC list also handles non-supplicant scanners, but assigning the restricted role from that list bypasses the required ISE profiling step before that role is granted. PEAP is a commonly deployed 802.1X method, but substituting it for EAP-TLS means the existing laptops no longer authenticate using their required method. Exam caveat: MAB is not itself device profiling; it supplies a MAC-based identity that ISE can use alongside profiling data in authorization policy. Practical check: verify the wired policy's authentication order and confirm in ISE live logs that a nonresponsive scanner reaches MAB, is profiled, and receives the restricted authorization result only afterward.