An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?

Low-impact mode is designed to introduce 802.1X into a network with minimal disruption to end-users, making it appear transparent. In this mode, a switch port provides limited network access, typically through a pre-authentication downloadable access control list (dACL), even before a user authenticates. This allows basic services like DHCP and DNS to function. Once the user successfully authenticates, a more permissive policy is applied. This approach meets the requirements of providing initial open access while enforcing strong security policies on non-authenticated devices by restricting their traffic.

A. closed: In closed mode, the switch port blocks all traffic except EAPOL frames until the supplicant is successfully authenticated. This is not transparent to the user.
C. open: In open mode (also known as monitor mode), all traffic is permitted regardless of authentication status. This fails the requirement for strong security for non-authenticated devices.
D. high-impact: This is not a standard, officially recognized 802.1X deployment mode in Cisco documentation. It is the conceptual opposite of the desired low-impact approach. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Chapter: Deploy and Manage Network Access Devices": This guide describes the three primary 802.1X deployment modes.

Section: 802.1X Deployment Modes: "In the low-impact mode

you can use a dACL to allow limited network access before authentication. For example

you can provide access to DHCP and DNS services so that endpoints can obtain an IP address." This directly supports the use of low-impact mode for the scenario.

The guide also defines Closed Mode as blocking all traffic until authentication and Monitor Mode (Open Authentication) as allowing all traffic while observing authentications

confirming why options A and C are incorrect.

2. Cisco TrustSec Phased Deployment Guide

"Chapter: Phased Deployment": This document outlines the strategy for deploying security solutions like 802.1X.

Section: Phase 2: Low-Impact Mode: "Low-Impact mode is a hybrid of Monitor mode and Closed mode. It allows you to lock down the port for unauthenticated users while still providing limited access to network resources." This confirms that low-impact mode balances initial access with security enforcement.

3. Cisco Live Presentation

BRKSEC-3699 - Advanced ISE Services

Tips and Tricks (2019)

Slide 15

"Deployment Modes": This presentation material

often derived from official documentation and best practices

details the deployment modes. It describes Low-Impact mode as using a pre-auth ACL for basic services

contrasting it with Closed mode (no access) and Monitor mode (full access)

reinforcing the selection of Low-Impact mode for this specific requirement.