A failed tablet is marked non-compliant by the mobile device manager, and ISE can see that result. The authorization rule for the clinical WLAN never checks it, so the tablet still lands on the production VLAN. What is missing?
Select an answer to reveal the explanation.
Short Explanation
The device manager already failed the tablet, and ISE can see it. Your rule never asks the question, so the tablet still gets the production VLAN. Make the rule require a compliant result.
Full Explanation
Compliance only changes access when an authorization rule uses it. ISE has the non-compliant result and the clinical rule never checks that result, so the tablet is authorized onto the production VLAN anyway. The missing piece is a rule that returns the production VLAN only when the result is compliant, and sends anyone else to remediation or a deny. An RF tag does not read compliance and does not classify a tablet as a noisy channel. A beacon interval does not clear a compliance attribute. Sniffer mode captures frames and does not make VLAN decisions. A non-compliant tablet is not quarantined by a capture. Seeing a compliance result is not the same as using it. The rule that returns the production VLAN has to require that result. Exam caveat: rule order matters. A broad rule above the compliance check will still hand out the production VLAN and the specific rule never runs. Operational check: fail a test tablet, confirm ISE shows non-compliant, and confirm the matched rule is the remediation or deny rule rather than the production one.