Cisco ISE: AI assistant (LLM)

Paste this into your AI assistant to have it help configure Cisco ISE so the RTA is admitted onto the network. It still pauses for your confirmation and for anything your version does differently.

Configuration prompt

You are helping me configure Cisco ISE so the Sophos Remote Testing Appliance
(RTA) is admitted onto the network and can reach its endpoint. Work through the
steps in order and show me the pending change before I save anything.

CONTEXT:
- This is a Network Access Control (NAC) problem, not a TLS-decryption problem.
  The job is to ADMIT the appliance's switch port / MAC and authorize it into the
  right segment, not to inspect its traffic.
- The RTA is a headless Linux appliance: no 802.1X supplicant, no domain
  membership, no posture agent. On an 802.1X-enforced port it falls through to MAC
  Authentication Bypass (MAB), so if MAB is not allowlisted the appliance gets
  quarantined or denied.
- Once admitted, the appliance's segment must allow outbound TCP/443 to
  connect.remotetesting.secureworks.com, which resolves to the static IPs
  3.33.194.251 and 15.197.255.2. Some appliances also register over HTTPS to
  get.remotetesting.secureworks.com; allow that one by FQDN (its IPs are not
  static), never by a hardcoded IP.

STEPS:
1. I have the appliance MAC address as <RTA_MAC>, written in aa:bb:cc:dd:ee:ff
   (colon-separated, lowercase) format, which is what ISE expects. (On Hyper-V,
   MAC-address spoofing is enabled on the appliance NIC, so confirm <RTA_MAC> is
   the address the switch actually learns via the switch MAC table or DHCP lease.)
2. Create an Endpoint Identity Group. Go to Administration > Identity Management >
   Groups > Endpoint Identity Groups > Add, and name it RTA-Appliances. Then
   register the endpoint: Context Visibility > Endpoints (or Administration >
   Identity Management > Identities > Endpoints) > Add, enter <RTA_MAC> in the MAC
   Address field, and set Identity Group to RTA-Appliances.
3. Confirm MAB authentication. In my Policy Set (or the Default policy set), verify
   there is a MAB authentication rule matching Wired_MAB (or Wireless_MAB) that
   uses the Internal Endpoints identity store. Do not change this unless my policy
   set uses a custom authentication order.
4. Create an Authorization Profile. Go to Policy > Policy Elements > Results >
   Authorization > Authorization Profiles > Add, name it RTA-Appliance-Access, and
   under Common Tasks check VLAN and enter the VLAN ID or name for the authorized
   segment that has outbound internet access. If my network enforces DACLs,
   optionally check DACL Name and select a permit-all downloadable ACL (the
   appliance needs unrestricted egress to its endpoint).
5. Add an Authorization rule. In my Policy Set's Authorization Policy, insert a rule
   above any catch-all or deny rule, name it RTA-Appliances-MAB, set the condition
   to IdentityGroup:Name EQUALS Endpoint Identity Groups:RTA-Appliances, and set
   Results > Profiles to RTA-Appliance-Access. Save and push the policy.
6. Ensure posture bypass. The RTA has no posture agent, so the RTA-Appliances-MAB
   rule and its profile must NOT include a posture condition (for example
   Session:PostureStatus EQUALS Compliant) and must NOT use a redirect ACL to the
   ISE posture portal. If a global posture-unknown rule would catch the session
   first, make sure the RTA-Appliances rule is evaluated before it or is excepted.
7. If my appliance is an activation-mode platform, confirm the authorized segment
   also permits HTTPS to get.remotetesting.secureworks.com by FQDN.
8. When the pending configuration is ready, show it to me. After I confirm, save
   and push the policy, then bounce the appliance's switch port (shutdown /
   no shutdown) or trigger a CoA re-authentication to apply it.

VERIFY:
- In Operations > RADIUS > Live Logs, filter by <RTA_MAC> and confirm the
  authentication shows Identity Group RTA-Appliances, Authorization Profile
  RTA-Appliance-Access, the correct VLAN assigned, and no posture redirect.
- From a host on the authorized segment (or the appliance once it has a DHCP
  lease), run:
  nc -vz connect.remotetesting.secureworks.com 443
  A success confirms the appliance can reach its endpoint; the tunnel should come
  up within a minute or two of the port authorizing.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a menu, command, or option does not match what
  is written here (versions differ), STOP and show me what you actually see. Do not
  guess at equivalent settings or invent CLI syntax.
- Make the narrowest change that allows this one destination. Do not broaden an
  existing rule to "any", and do not disable, bypass, or pause the firewall, TLS/SSL
  decryption, or threat inspection globally to make it work.
- Allowlist connect.remotetesting.secureworks.com. Its two IPs (3.33.194.251 and
  15.197.255.2) are static, but get.remotetesting.secureworks.com (used on some
  platforms) is not, so allow that one BY FQDN, never by a hardcoded IP.
- Do not apply, commit, or deploy the change until I confirm. Show me the pending
  configuration first.
- Change only what these steps describe. Do not alter unrelated rules, objects, or
  policy, and do not touch anything outside allowing this destination.