A noncompliant laptop should be able to reach only the internal patch server and the ISE nodes needed for posture, and nothing else, while remaining on its normal access VLAN. How is this enforced in a Cisco ISE design?
Select an answer to reveal the explanation.
Short Explanation
Picture a hallway pass that lets you walk to the nurse's office and nowhere else. A downloadable ACL is that pass: ISE hands it to the switch, and the switch enforces it right on the port. Since you're staying on the same VLAN, the ACL is the thing doing the restricting.
Full Explanation
In Cisco ISE, the access an endpoint receives is defined by the authorization profile returned when an authorization rule matches. For noncompliant endpoints, that profile commonly includes a downloadable ACL that ISE sends to the network device over RADIUS. The switch applies the ACL to the session on the port, so the laptop can reach only the destinations permitted, here the patch server and the ISE nodes, while staying on its normal VLAN. When posture later reports compliant, a change of authorization replaces the profile with full access. A posture requirement defines what the agent checks and how to remediate; network devices do not read posture requirements, and requirements do not filter traffic. Profiling classifies devices by type from network attributes; it does not assess compliance, and moving a wired laptop to a quarantine SSID is not possible and would contradict the requirement to stay on the normal VLAN. TACACS+ command sets authorize administrator commands on network devices and have no role in endpoint traffic filtering. Exam caveat: a VLAN change is an alternative restriction method, but it needs the endpoint to renew its address, which is one reason dACLs are often preferred. Operational check: on the switch, display the authentication session for the laptop, confirm the downloadable ACL is applied, and test that only the patch server is reachable.