“Legacy IP-based firewall rules cannot distinguish between a software developer and a finance manager on the same subnet. Identity-Based 802.1X Access Control fixes this.”

At Wipro, legacy network authentication relied on end-of-life Cisco ACS (Access Control Server) boxes that lacked context-aware identity profiling.

Architecture: Zero Trust Identity & Web Security

We executed a multi-phase identity and web security migration for 10,000 corporate endpoints.

• Cisco ISE (Identity Services Engine): Deployed 802.1X dot1x authentication integrated with Active Directory. Dynamic VLAN assignment and Security Group Tags (SGTs) enforced user-based network access regardless of physical port connection.
• McAfee Web Gateway (MWG): Installed active ICAP SSL inspection proxies to decrypt outbound HTTPS traffic, blocking malware downloads and unapproved cloud storage uploads.

[!IMPORTANT] Deploy Cisco ISE in Monitor Mode for 30 days before enabling Low-Impact or Closed Mode enforcement to identify non-dot1x legacy devices without breaking user connectivity.

# # Cisco Switch 802.1X Interface Configuration for ISE Integration
interface GigabitEthernet1/0/10
 description User-Access-Port
 switchport mode access
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator

The Verdict

Key Takeaway

Transition Network Access Control from Static Subnets to Context-Aware Identity.

Migrating to Cisco ISE and McAfee Web Gateway establishes granular Zero Trust identity enforcement across enterprise campus networks.