Cisco Identity Services Engine (ISE) is a comprehensive security policy management platform that provides identity-based network access control and policy enforcement. It enables enterprises to gather real-time contextual information about users, devices, and network conditions to make informed access control decisions. Cisco ISE supports a scalable architecture with centralized management, allowing deployment as standalone, high availability, or distributed systems. It integrates with various network elements such as switches, wireless controllers, VPN gateways, and private 5G networks to enforce consistent security policies. Cisco ISE helps enterprises ensure compliance, enhance infrastructure security, and streamline service operations by creating and applying granular access policies based on user identity, device type, location, and other contextual factors. Cisco ISE is available on Cisco Secure Network Server appliances, virtual machines, and public clouds, supporting diverse deployment scenarios and use cases.

Cisco ISE network architecture integrates specialized nodes and deployment models to deliver comprehensive, scalable network access control and security policy enforcement.

The core components include nodes with specific personas that work together to manage network access and security. It supports various deployment models, including standalone and distributed setups, suited for small to large networks. This architecture ensures scalable, secure, and efficient policy enforcement across wired, wireless, and VPN connections.

Cisco ISE network architecture components

Cisco ISE architecture includes these components:

Table 1. Components of Cisco ISE network architecture

Cisco ISE network components	Description
Nodes (personas or roles)	Cisco ISE servers that run one or more roles. A node can run multiple personas.
Network resources	Infrastructure that controls or provides network access, such as switches, WLCs, VPN devices and so on.
Endpoints	Users or devices trying to connect to the network, such as laptops, phones, printers, IoTand so on.

Cisco ISE nodes and personas

A Cisco ISE node can assume any or all of these personas:

Table 2. Cisco ISE nodes and personas

Persona	Role	Use cases
Administration persona	Manages configuration and system settings	Primary or secondary admin nodes
Policy Service persona (PSN)	Makes access-control decisions and enforces policy The policy information point (PIP) is where external information is communicated to the Policy Service persona. For example, external information might be a Lightweight Directory Access Protocol (LDAP) attribute.	RADIUS and TACACS+ processing
Monitoring persona	Collects logs and reporting data	Troubleshooting, audits, reports
pxGrid persona	Shares context with other systems	Integrations with security tools