A. Deploy a single sign-on infrastructure such as ping, and integrate ISE, ASA, and WSA with it. Access
policies are applied based on the user group membership retrieved from the authentication
infrastructure.

B. Integrate ISE, ASA, and WSA with Active Directory. After the user is authenticated to the network
through ISE, the ASA and WSA will automatically extract the identity information from AD to apply the
appropriate access policies.

C. Deploy ISE, integrate it with Active Directory, and based on group membership authorize the user to
specific VLANs. These VLANs (with specific subnets) should then used in access policies on the ASA
as well as the WSA

D. Configure ISE as an SSO service provider, and integrate with ASA and WSA using pxGrid. ASA and
WSA can extract the relevant identity information from ISE to apply to the access policies after the user
has authenticated to the network.

E. Deploy Cisco TrustSec infrastructure, with ASA and WSA integrated with ISE to transparently identify
users based on SGT assignment when the user authenticates to the network. The SGTs can then be
used in access policies.

F. Configure ISE to relay learned SGTs for the authenticated sessions with the bound destination address
using SXP to SXP speakers that will be used to apply access policies at the traffic ingress point for
segmentation.