What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

SNMP version alignment is important for device management and monitoring, but it is not a direct requirement for the RADIUS authentication process itself.

A shared secret, a pre-configured password, must be identical on both the Cisco ISE Policy Service Node (PSN) and the Network Access Device (NAD) to securely encrypt and authenticate RADIUS communication between them.

While certificates can be used for EAP-TLS authentication methods, a shared secret is the fundamental requirement for the NAD to communicate securely with the ISE PSN for RADIUS authentication in general.

Endpoint profiles are used by ISE for authorization decisions and dynamic policy assignment *after* authentication, not as a matching requirement for the initial RADIUS authentication between the NAD and ISE.