IBNS: who gets into the network and with what rights
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, there's a simulator where you change it yourself.
TL;DR
IBNS (Identity-Based Networking Services) means: the network port no longer grants access based on which jack you plug into, but based on who you are. Three roles — supplicant (the client), authenticator (the switch / WLC) and authentication server (RADIUS, typically Cisco ISE). The client speaks EAP with the switch over EAPoL; the switch wraps the EAP in RADIUS and asks ISE. A device with a supplicant authenticates via 802.1X; one without, via MAB (the MAC address); a visitor, through a web portal (WebAuth). ISE replies with Access-Accept plus the authorization: dynamic VLAN, dACL, SGT or redirect — each with a local precondition on the switch. CoA changes the policy without pulling the cable. You deploy in phases (monitor → low-impact → closed), with redundant servers and fallback access when ISE goes down. IBNS 2.0 writes it all as C3PL policies.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms, standards and IBNS 1.0 ↔ 2.0. In the animations, the configuration lines used at the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of an office building where access doesn't depend on which door you enter, but on your badge: at every door there's a turnstile that won't let you through until you identify yourself, and the receptionist doesn't decide alone — they call the records office (HR), the only one who knows who you are and what you're allowed to do.
The model holds up to §8. From §9 onward (C3PL policies, phased deployment, HA), it breaks down; see the full analogy and its limits in §13.