Pricey but justified for unique expandability.

We have deployed ISE company wide in a default deny environment. We use these in specific locations for control systems where environment is harsh. Used for vital communication at a multiple power plants. This gives us a way to keep our level of security but also provide networking equipment for the contractors that manage our controls networks.

Well, we where told by Cisco that it cant be managed by Catalyst Center. So I will absolutely need to revisit that. But over all, Cisco Catalyst Center has been an absolute nightmare. We use Cisco ISE for network access in a default deny environment. TACACS for all CLI connections and configured for local auth to fail if ISE is reachable at all. But, Catalyst Center is an absolute dumpster fire to do a brownfield deployment. It will not overwrite any of the AAA configurations. So you need to either not use Catalyst Center (DNA) for devise provisioning and config management, or nearly wipe every switch to re-provision with DNA (Catalyst Center)

We use ISE for network access and have a default deny environment. Using the Cisco IE line of switches we are able to push these standards into the IoT environment. We use ISE to actually assign vlans depending on authorization. This allows us to make sure that if a contractor or employee plugs into these networks, they dont actually get access to the networks they are not supposed to.