J

Cisco ISE is more than a RADIUS server. It is the policy decision point for 802.1X, layering device type, posture, and context on top of pass/fail authentication.

RADIUS CoA lets ISE push policy updates to the switch mid-session, no re-auth required. Here is the IOS XE and ISE config, plus the posture remediation use case.

Web authentication adds a captive portal as an 802.1X fallback for guests, contractors, and unmanaged endpoints. Here is the Cisco IOS XE and ISE config.

Multi-domain authentication lets an IP phone and a PC share one 802.1X port with separate voice and data VLANs. Here is the Cisco IOS XE config and verification.

dACLs move ACL definitions off the switch and into ISE, delivered per session via RADIUS. Here is how the download mechanism works and how to configure both sides.

Guest VLAN, Auth-Fail VLAN, and Critical VLAN cover the three 802.1X failure paths: no supplicant, wrong credentials, and RADIUS down. Here is when and how to use each.