When a wired client connects to an edge switch in an SDA fabric, which component decides whether the client has access to the network?

Question

Options

• Acontrol-plane node
• BIdentity Service Engine
• CRADIUS server
• Dedge node

• A
  6% (2)
• B
  87% (27)
• C
  3% (1)
• D
  3% (1)

Explanation

SDA Client Authentication Explanation

Identity Service Engine (ISE) is the policy and authentication engine in Cisco Software-Defined Access (SDA). When a wired client connects to an edge switch, ISE acts as the central policy decision point - it authenticates the client (via 802.1X, MAB, or web auth), authorizes it, and assigns it to the correct Virtual Network (VN) and Scalable Group Tag (SGT), effectively deciding whether and how the client accesses the network.

• Option A (Control-plane node) is wrong because it handles LISP-based mapping and endpoint location/routing - it doesn't make access decisions.
• Option C (RADIUS server) is a distractor; while ISE uses RADIUS protocol to communicate, a generic RADIUS server lacks the full SDA policy intelligence that ISE provides. ISE is the RADIUS server in SDA context, but the question points to ISE specifically.
• Option D (Edge node) is wrong because it enforces the policy (applies SGTs, VN assignments) but doesn't decide - it relies on ISE's instructions.

Memory Tip: Think of ISE as the "bouncer with the guest list" - the edge node is just the door. ISE decides who gets in and where they can go; the edge node simply enforces that decision.

No community discussion yet for this question.