Cisco ISE configuration capabilities include the following features:

ISE Deployment Assistant (IDA): This is a built-in application designed to accelerate the deployment of Cisco Identity Service Engine (ISE) by providing a guided workflow for configuring the most common ISE use cases, such as guest access, BYOD, and secure wired and wireless access 1 . IDA also provides validation checks, best practices, and troubleshooting tips to ensure a successful deployment.

Wireless Setup Wizard and Visibility Wizard: These are two of the several wizards that Cisco ISE provides to simplify the configuration of various ISE functions and features.  The Wireless Setup Wizard helps to configure the wireless network settings, such as SSIDs, authentication methods, and policies, for secure wireless access 2 .  The Visibility Wizard helps to enable the ISE profiling service, which collects and analyzes endpoint data to identify, classify, and monitor devices on the network 3 .

ISE Wizards and Pre-Canned Configurations: These are the tools that ease the ISE roll-out significantly by providing ready-made templates, policies, and settings for common ISE scenarios, such as posture assessment, device administration, and threat-centric NAC. These tools help to reduce the manual configuration efforts and errors, and speed up the time to value.

References :

  1 : [Cisco Identity Services Engine Administrator Guide, Release 3.3 - ISE Deployment Assistant [Cisco Identity Services Engine]] :  2 : [Cisco Identity Services Engine Administrator Guide, Release 3.3 - Wireless Setup Wizard [Cisco Identity Services Engine]] :  3 : [Cisco Identity Services Engine Administrator Guide, Release 3.3 - Visibility Wizard [Cisco Identity Services Engine]] : : [Cisco Identity Services Engine Administrator Guide, Release 3.3 - ISE Wizards and Pre-Canned Configurations [Cisco Identity Services Engine]]

https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.1/04Segmentation/02Configuring_Segmentation_(VPNs)

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/sd-wan/nb-07-clo ud-router-data-sheet-cte-en.pdf

A vEdge Cloud Router is a virtualized version of the vEdge router that can be deployed in various cloud environments.  According to the Cisco vEdge Cloud Data Sheet 1 , the vEdge Cloud Router can be instantiated as a virtual machine (VM) on a KVM hypervisor or as a VM on a VMware ESXi hypervisor, as well as in public cloud environments, such as Amazon AWS or Google Cloud Platform. Therefore, the two platforms that can host a vEdge Cloud Router are AWS and Microsoft Azure.

References :

  1 : [Solutions - Cisco vEdge Cloud Data Sheet - Cisco]

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/1-2/user_guide/b_dnac_ug_1_2/b_dnac_ug_1_2_chapter_010010.pdf

The workflow that is necessary for setting up a network hierarchy is Design. The Design area is where you create the structure and framework of your network, including the physical topology, network settings, and device type profiles that you can apply to devices throughout your network. You can create a network hierarchy that represents your network’s geographical locations, such as sites, buildings, and floors. You can also define global network settings, such as device credentials, IP address pools, service provider profiles, and network servers.  You can also create network profiles, which are collections of design settings that you can assign to devices based on their roles and functions 1 .

References :

  1 : [Cisco DNA Center User Guide, Release 2.2.3 - Design Network Hierarchy and Settings [Cisco DNA Center] - Cisco]

SD-WAN is a software-defined approach to managing the WAN that offers several capabilities, such as:

The separation of management plane, control plane and data plane to enable horizontal scaling. This means that the SD-WAN solution can decouple the network functions from the underlying hardware and distribute them across different layers and locations.  This allows for greater flexibility, scalability, and resilience of the network 1 2

Cloud hosted or on-premise fully redundant management and control plane functions. This means that the SD-WAN solution can provide centralized and cloud-based management and control of the network, as well as the option to deploy them on-premise for more control and security.  This enables the SD-WAN solution to offer consistent policies, visibility, and analytics across the network, as well as the ability to automate network operations and orchestration 1 3

The other options are not SD-WAN solution capabilities, but rather features or benefits of specific SD-WAN solutions, such as:

Trust roll branch turn up for easy provisioning and new installations.  This is a feature of Cisco Catalyst SD-WAN, which enables zero-touch provisioning and automated configuration of branch devices, as well as the ability to trust the identity and security posture of the devices 3

Ability to provide and integrate security with complementary products and applications. This is a benefit of Cisco Catalyst SD-WAN, which offers integrated security capabilities, such as full-stack multilayer security, cloud-delivered security, and SASE-enabled architecture.  This enables the SD-WAN solution to provide real-time threat protection and compliance across the network 3

References  :=

What Is SD-WAN? - Software-Defined WAN (SDWAN) - Cisco

SD-WAN Solution - Cisco Catalyst SD-WAN Solution Overview

What is SD-WAN? - Software-Defined WAN | VMware

The maximum number of concurrent endpoints with a distributed deployment depends on the type of deployment and the hardware used.  According to the Cisco documentation 1 , there are two types of distributed deployments: hybrid and dedicated.

A hybrid deployment is where the Policy Administration Node (PAN) and the Monitoring Node (MnT) personas are co-located on the same node, and the Policy Service Node (PSN) persona is distributed across multiple nodes. A hybrid deployment can support up to  20,000  concurrent endpoints with a maximum of  5  PSNs on SNS-36xx or SNS-35xx hardware.

A dedicated deployment is where the PAN, MnT, and PSN personas are separated on different nodes. A dedicated deployment can support up to  500,000  concurrent endpoints with a maximum of  50  PSNs on SNS-36xx or SNS-35xx hardware.

The main difference between the hybrid and dedicated deployments is the scalability and redundancy of the MnT persona, which collects and stores the logs and sessions from the PSNs.  By breaking the PAN and MnT roles out on to their own servers, the dedicated deployment can handle more concurrent endpoints and PSNs, as well as provide failover and load balancing for the MnT persona 2

References  :=

Performance and Scalability Guide for Cisco Identity Services Engine

Solved: ISE concurrent connections query - Cisco Community

https://www.ciscolive.com/c/dam/r/ciscolive/latam/docs/2017/pdf/BRKEWN-2032.pdf

The current DNA-C 1.1 release supports the following wireless product families:

WLC 3504: This is a wireless LAN controller that provides centralized control, management, and troubleshooting for small to medium-sized enterprises and branch offices. It supports up to 150 access points and 3,000 clients, and offers high availability, scalability, and security features.  It is compatible with Cisco DNA Center 1.1 and later releases 1 .

WLC 8540: This is a wireless LAN controller that provides centralized control, management, and troubleshooting for large enterprises and service providers. It supports up to 6,000 access points and 64,000 clients, and offers high performance, reliability, and flexibility.  It is compatible with Cisco DNA Center 1.1 and later releases 2 .

AP 3800: This is an access point that delivers high-performance wireless connectivity for indoor and outdoor environments. It supports 802.11ac Wave 2 technology, multiuser multiple-input multiple-output (MU-MIMO), flexible radio assignment, and modular design.  It is compatible with Cisco DNA Center 1.1 and later releases 3 .

References :

  1 : [Cisco Wireless LAN Controller 3504 Data Sheet - Cisco] :  2 : [Cisco 8540 Wireless Controller Data Sheet - Cisco] :  3 : [Cisco Aironet 3800 Series Access Points Data Sheet - Cisco]

 Identity management is the practice of making sure that people and entities with digital identities have the right level of access to enterprise resources like networks and databases.  User roles and access privileges are defined and managed through an identity management system, such as Cisco Identity Services Engine (ISE) 1 . Identity management solves two customer problems:

Provides network visibility and security: Identity management allows customers to see who and what is on their network, and to control their access based on policies and context.  Identity management also integrates with other security solutions, such as Cisco Firepower, Cisco Stealthwatch, or Cisco Umbrella, to detect and respond to threats, and to enforce adaptive network access policies based on the threat level of the endpoints 2 .

Achieves dynamic and adaptive network segmentation: Identity management enables customers to segment their network based on the identity and context of the users and devices, rather than the IP addresses and VLANs. This allows customers to implement a zero-trust model, where only trusted users and devices can access the resources they need, and where the access policies can be dynamically updated based on the changing conditions and requirements.  Identity management also supports Cisco TrustSec, which is a technology that assigns scalable group tags (SGTs) to endpoints and enforces group-based policies (contracts) across the network 3 .

References :

  1 : [What Is Identity Access Management (IAM)? - Cisco

Device Sensor is a feature that enables Cisco devices to collect and report information about the endpoints connected to them. This information can be used by ISE to identify and classify the endpoints, and apply appropriate policies based on their attributes. Device Sensor can collect information from various sources, such as DHCP, CDP, LLDP, and HTTP User-Agent. Among the options given, only DHCP and CDP are valid sources of information for Device Sensor.  References  := : Cisco Identity Services Engine Administrator Guide, Release 2.7 - Device Sensor [Cisco Identity Services Engine] - Cisco (https://learningnetworkstore.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_010100.html)

2of30