According to the Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers document1, the three Cisco recommendations on “How to Win” are:

• Explain support for 3rd party network devices: Cisco ISE can integrate with more than 60 third-party solutions that span across security and network portfolios. This enablesCisco ISE to leverage the information and capabilities of these solutions to enhance the identity and access management, network visibility and segmentation, threat detection and response, and policy enforcement of the network. By explaining this support, the customer can see the value and flexibility of Cisco ISE in their existing or heterogeneous network environment2.
• Explain architectural advantage of holistic Cisco solution: Cisco ISE is part of the Cisco Digital Network Architecture (DNA), which is a comprehensive and open platform that provides end-to-end network automation, assurance, security, and analytics. By explaining the architectural advantage of the holistic Cisco solution, the customer can see how Cisco ISE works seamlessly with other Cisco DNA components, such as Cisco DNA Center, Cisco SD-Access, Cisco SD-WAN, Cisco TrustSec, and Cisco Stealthwatch, to deliver a unified and consistent network experience across wired, wireless, and cloud domains3.
• Talk about Cisco’s focus on Security and integration with StealthWatch, Sourcefire, WSA, vulnerability scanner to make smarter policy decisions: Cisco ISE is a core component of the Cisco security portfolio, which provides comprehensive and integrated security solutions for the network. By talking about Cisco’s focus on security and integration with other security products, such as StealthWatch, Sourcefire, WSA, and vulnerability scanner, the customer can see how Cisco ISE can provide enhanced visibility, threat detection, and policy enforcement for the network. For example, Cisco ISE can use the data from StealthWatch to identify anomalous or malicious behavior of the endpoints and apply appropriate network access policies based on the threat level4.

The other options, show case Cisco portfolio or ISE feature set during PoC and demonstrate complex policy flows, rather show case Wizards and enhanced context visibility, are not Cisco recommendations on “How to Win”. Showing case Cisco portfolio or ISE feature set during PoC is a general best practice, but not a specific recommendation for winning the customer. Demonstrating complex policy flows, rather than showing case Wizards and enhanced context visibility, is a counterproductive approach, as it can confuse or overwhelm the customer with technical details, rather than highlighting the benefits and simplicity of Cisco ISE. References := : 2: Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Security Ecosystem Integration Guides [Cisco Identity Services Engine] - Cisco2, 1: Cisco Enterprise Networks SDA, SDWAN and ISE Exam for System Engineers1, 3: Cisco Identity Services Engine - Cisco3, 4: Cisco Identity Services Engine Administrator Guide, Release 2.7 - Stealthwatch Integration [Cisco Identity Services Engine] - Cisco4

The Cisco SD-WAN subscription cost is based on two factors: the features and the service bandwidth. The features are determined by the subscription tier, which can be Cisco DNA Essentials, Cisco DNA Advantage, or Cisco DNA Premier. Each tier offers different levels of functionality, security, and analytics for the SD-WAN solution. The service bandwidth is the aggregated WAN bandwidth across all the edge devices in the SD-WAN fabric. The subscription cost is calculated as the product of the feature price per Mbps and the service bandwidth. For example, if the feature price per Mbps for Cisco DNA Advantage is $2 and the service bandwidth is 100 Mbps, the subscription cost for one year is $2 x 100 x 12 = $240012

The other factors, such as the hypervisor platform, the security, and the routing protocol, are not used in calculating the Cisco SD-WAN subscription cost. The hypervisor platform is the virtualization environment where the SD-WAN edge software can run, such as VMware ESXi, KVM, or Microsoft Hyper-V. The security is the protection of the SD-WAN network from threats and attacks, which can be enhanced by integrating with complementary products and applications, such as Cisco Umbrella, Cisco SIG Essentials, or Cisco Secure Malware Analytics. The routing protocol is the method of exchanging routing information between the SD-WAN edge devices and the external networks, such as BGP, OSPF, or EIGRP. These factors are not directly related to the subscription cost, but rather to the deployment options, the security requirements, and the network design of the SD-WAN solution34

References :=

• Cisco DNA Software for SD-WAN and Routing Ordering Guide
• Cisco DNA Subscription Software for SD-WAN and Routing FAQ
• Cisco SD-WAN Solution Overview
• Cisco SD-WAN Configuration Guide

Device Sensor is a feature that enables Cisco devices to collect and report information about the endpoints connected to them. This information can be used by ISE to identify and classify the endpoints, and apply appropriate policies based on their attributes. Device Sensor can collect information from various sources, such as DHCP, CDP, LLDP, and HTTP User-Agent. Among the options given, only DHCP and CDP are valid sources of information for Device Sensor. References := : Cisco Identity Services Engine Administrator Guide, Release 2.7 - Device Sensor [Cisco Identity Services Engine]- Cisco (https://learningnetworkstore.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_010100.html)

2of30

Cisco ISE configuration capabilities include the following features:

• ISE Deployment Assistant (IDA) is a built-in application designed to accelerate the deployment of Cisco Identity Service Engine (ISE). IDA guides the user through the initial setup, configuration, and verification of ISE with a step-by-step wizard. IDA also provides best practices and recommendations for common deployment scenarios, such as wireless, wired, VPN, guest, and BYOD1.
• Cisco ISE includes wireless setup wizard and visibility wizard. The wireless setup wizard simplifies the configuration of ISE for wireless access by automating the tasks of adding network devices, creating authorization profiles, and applying policies. The visibility wizard helps the user to enable device profiling and posture services, and to view the endpoint information and compliance status on the ISE dashboard2.
• ISE wizards and per-canned configurations ease ISE roll-out significantly. ISE wizards are interactive tools that assist the user in configuring various features and functions of ISE, such as certificates, network access devices, authentication and authorization policies, guest access, BYOD, and TrustSec. Per-canned configurations are predefined templates that provide common settings and values for ISE components, such as policy sets, authorization profiles, and network conditions. The user can apply these templates to quickly configure ISE for specific use cases, such as 802.1X, MAB, or web authentication3.

The other options, Cisco Active Advisor and ISE command line, are not accurate descriptions of ISE configuration capabilities. Cisco Active Advisor is a separate cloud-based service that provides network health and security checks, device lifecycle management, and best practice recommendations for Cisco devices. It is not directly related to ISE deployments. ISE command line is an interface that allows the user to perform administrative tasks, such as backup and restore, password recovery, and troubleshooting. However, ISE does not require an understanding of the command line for set-up and configuration, as most of the functions can be done through the graphical user interface (GUI). References := : 1: ISE Deployment Assistant (IDA) - Cisco Identity Services Engine - Cisco, 2: Cisco Identity Services Engine Administrator Guide, Release 2.7 - Wireless Setup Wizard [Cisco Identity Services Engine] - Cisco, 3: Cisco Identity Services Engine Administrator Guide, Release 2.7 - ISE Wizards [Cisco Identity Services Engine] - Cisco, : Cisco Active Advisor - Cisco, : Cisco Identity Services Engine CLI Reference Guide, Release 2.7 - Using the Command-Line Interface [Cisco Identity Services Engine] - Cisco

Self-healing functionality on vEdges refers to the ability of the vEdge routers to recover from failures or errors that affect their connectivity or performance. Two examples of self-healing functionality on vEdges are:

• In software upgrade process, rolling back to the previously running software image when connectivity to vManage fails: When a vEdge router is upgraded to a new software version, it maintains a backup copy of the previous software image and configuration. If the vEdge router loses connectivity to the vManage controller during or after the upgrade process, it automatically reboots and restores the previous software image and configuration. This ensures that the vEdge router can resume its normal operation and reconnect to the vManage controller1.
• With configuration change, rolling back the configuration change when loss of connectivity to vManage: When a vEdge router receives a configuration change from the vManage controller, it applies the change and verifies the connectivity to the vManage controller. If the vEdge router detects that the configuration change has caused a loss of connectivity to the vManage controller, it automatically reverts the configuration change and restores the previous configuration. This prevents the vEdge router from being isolated from the vManage controller and the rest of the SD-WAN fabric2.

References:

• : Software Upgrade for vEdge Routers - Viptela Documentation
• : Configuration Rollback - Viptela Documentation