Cisco ISE vs Meraki Access Manager: choosing your NAC platform

If your network runs on Meraki gear and someone has asked you to put network access control in place, Cisco now gives you two answers. Cisco ISE is the on-premises platform that has done this job for over a decade. Meraki Access Manager is the cloud service Cisco made generally available on November 10, 2025, inside the Meraki dashboard you already log into.

The Cisco ISE vs Meraki Access Manager question comes up on most NAC calls we take now. The answer is almost never "whichever is cheaper." It depends on what your switches and access points are, where your identities live, what your insurer or auditor expects, and who will run the system afterward.

What each platform is

Access Manager is RADIUS as a service. Authentication, authorization, and accounting run in the Meraki cloud, and your switches and access points send requests over the management tunnel they already use. It authenticates managed endpoints with EAP-TLS certificates, or with EAP-TTLS/PAP credentials checked against Microsoft Entra ID. Unmanaged devices get MAC authentication bypass on wired ports and identity PSK on wireless. Authorization can assign a VLAN, an ACL, a group policy, or a TrustSec security group tag. It is sold as one license, Access Manager Advantage, metered on concurrent endpoint sessions.

ISE is software you install and own. A deployment is built from nodes with personas: policy administration, monitoring, policy service, and pxGrid. A standalone node suits networks under about 1,000 endpoints; a large deployment can reach 58 nodes, on Cisco SNS appliances or virtual machines with full CPU and memory reservation. Licensing is tiered: Essentials covers 802.1X, MAB, web authentication, guest, and passive identity; Advantage adds profiling, BYOD, TrustSec, and pxGrid; Premier adds posture and MDM compliance. TACACS+ needs a separate Device Administration license per policy service node.

Where Access Manager stops today

This is the part the sales deck skips. It is all in Cisco's documentation as of October 2026.

One identity provider. Microsoft Entra ID is the only supported identity source. Entra group lookup works for users but not for devices, and Meraki organization local users cannot be used for 802.1X username and password authentication. Cisco says more identity providers are planned. "Planned" is not a date you can build a project around.

Meraki-managed devices only. Every network device must reach the Meraki dashboard through its management tunnel: MR access points on firmware 30.7 or later, MS switches on 17 or later, and cloud-configured Catalyst 9200L, 9300, 9350, and 9500H switches on specific IOS XE releases. MX and Z appliances carry only static security group tags. A Catalyst switch managed through Catalyst Center or the CLI, a Catalyst 9800 controller, and any non-Cisco switch are out.

No change of authorization. RADIUS CoA is listed as not supported. If your EDR flags a laptop, there is no mechanism to move it to a quarantine VLAN mid-session.

No posture. Compliance checking against a UEM is listed as not supported. Access Manager reads certificate attributes and Entra user groups; it cannot ask whether the disk is encrypted or the agent is running.

Limited profiling. Cloud-based profiling, generally available since July 1, 2026, labels endpoints with type, manufacturer, model, and operating system from CDP, DHCP, and LLDP. Custom profiling rules are not supported, so when badge readers show up as unknown, you build a MAC-based client group by hand.

No TACACS+ and no pxGrid. Neither appears in the Access Manager documentation. Switch administration logins and context sharing with firewalls stay with ISE.

Where ISE earns its weight

ISE joins Active Directory directly, with up to 50 join points, including domains with no trust between them. It does machine authentication, pulls group membership for authorization, and can match an EAP-TLS certificate against the one stored on the AD computer object.

It talks to any standards-based RADIUS network device. Cisco's validated list covers Catalyst switches from the 2960 to the 9600, Catalyst 9800 controllers, ISR and Catalyst 8000 routers, and Meraki MR, MS, and MX. A mixed estate is ISE's normal case.

Posture, MDM compliance, pxGrid, TACACS+, and CoA are all there, each behind the right license tier. Starting with release 3.5, profiling, TrustSec, and pxGrid consume an Advantage license per active endpoint, so the tier you buy has to match the features you turn on. The trade-off: all of it is yours to patch, certify, back up, and size.

Cisco ISE vs Meraki Access Manager: the decision framework

Choose Access Manager when all of these are true: your switching and wireless are Meraki or cloud-configured Catalyst; your users and groups are in Entra ID; VLAN, ACL, and security group tags are enough to express your policy; nobody is asking for endpoint posture; and you have no engineer to run a server. For a Meraki office of 50 to 300 users with Intune pushing certificates, this is the right answer.

Choose ISE when any of these are true: you have Catalyst switches in IOS XE or Catalyst Center mode, a 9800 controller, or non-Cisco gear; your identities are in on-premises Active Directory; your insurer, PCI assessor, or CMMC scope requires posture checks; you need TACACS+ for switch administration; your firewall or EDR needs session context over pxGrid; you need CoA to quarantine a device on demand; or you already run ISE. Do not replace a working ISE to save a server.

Run both when Meraki branches sit beside a Catalyst campus. Neither product's documentation describes the two sharing policy, so plan on two policy sets and one naming convention.

One sizing note. Access Manager licensing counts peak concurrent endpoints, taken as the 90th percentile of daily peaks over the last ten days, and Cisco recommends a 10 to 15 percent buffer. Count printers, phones, cameras, and personal devices on the corporate SSID, not just laptops.

What picking wrong costs

Pick Access Manager and then get a cyber insurance renewal that asks whether non-compliant devices are blocked, and you re-platform under a deadline. Pick ISE for a two-switch Meraki office with no one to run it, and you pay for appliances and licenses that sit in monitor mode, the failure we covered in why most NAC projects never reach enforcement.

What both get wrong without ongoing operation

The cloud does not run NAC for you. Access Manager's wired behavior during a dashboard outage depends on RADIUS caching, Guest VLAN, critical-auth VLAN, and failed-auth VLAN settings under Switching > Access Policies, and those options only arrived in April and July 2026. If nobody set them, a loss of cloud connectivity is an outage. Certificate revocation lists need a reachable URL and a review cadence. MAB client groups rot as devices are replaced. License compliance is measured daily, and the 30-day grace clock starts whether or not anyone is watching.

ISE has the same problems with more surface. Patches arrive on Cisco's schedule. Admin, EAP, and portal certificates expire on known dates that still surprise people. Snapshots are unsupported, so recovery depends on a backup job someone verified. Version drift between ISE and the switches it serves changes RADIUS behavior at 8 a.m. on a Monday.

On both platforms, the exception list grows after go-live, and nobody reads the session logs until something breaks. NAC needs that attention for its whole life, not just during the project.

When to talk to us

If you are choosing between these two, or you own one and it is not enforcing, that is what our managed and co-managed NAC service exists for; if wireless design is part of the decision, Wi-Fi consulting joins the same conversation. The first step is a 30-minute intro call where we listen to your situation and tell you which platform we would pick and why. Book it on our calendar or request a call back at padlocktech.com/#contact.