Cisco ISE vs. Purple WiFi: How They Compare and Work Together

You are a senior network security consultant briefing a client in American English with a confident, authoritative, and conversational tone. Speak clearly and at a measured pace, as if presenting to a boardroom of IT directors and network architects. This is a professional technical briefing, not a lecture. Speak in American English with a standard American accent: Welcome to the Purple technical briefing series. Today we're covering a question that comes up constantly in enterprise network design: Cisco ISE versus Purple WiFi. How do they compare, and more importantly, how do they work together? I'm going to give you the straight answer in about ten minutes. [medium pause] Let's start with context. If you're running a hotel, a retail property, a stadium, or an affordable housing or student housing building, you almost certainly have two distinct populations connecting to your network. You have staff and corporate devices, and you have guests, visitors, fans, or shoppers. These two populations have completely different authentication requirements, different data rights, and different business objectives. The mistake most organizations make is trying to solve both problems with a single tool. That's where the confusion between Cisco ISE and Purple comes from. [medium pause] Section one: what Cisco ISE actually does. Cisco Identity Services Engine, or ISE, is Cisco's enterprise Network Access Control platform. Its job is to authenticate and authorize corporate devices and staff users. It does this primarily through IEEE 802.1X, which is the port-based network access control standard. When a corporate laptop connects to your network, ISE checks its certificate via EAP-TLS, or its credentials via PEAP, validates it against Active Directory or Microsoft Entra ID, assesses its security posture, and then assigns it to the correct VLAN with the correct policy. If the device fails posture assessment, ISE can quarantine it automatically using RADIUS Change of Authorization, or CoA. ISE also handles BYOD onboarding, where personal devices are enrolled with a certificate so they can authenticate securely without a shared password. And it integrates with Cisco's pxGrid framework, which allows other security tools like firewalls and SIEM platforms to consume real-time identity context. The three ISE license tiers are Essentials, Advantage, and Premier. Essentials covers 802.1X and basic guest access. Advantage adds BYOD, posture assessment, and third-party MDM integration. Premier adds passive identity services and advanced threat integration. [medium pause] So ISE is a serious, enterprise-grade security platform. But here is the critical point: its guest portal is functional, not commercial. ISE can redirect an unauthenticated device to a web page, collect a username and password or a sponsor approval, and grant internet access. What it cannot do is capture CCPA/CPRA-compliant marketing consent, run branded splash pages with social login, feed visitor data into Salesforce or HubSpot, generate footfall heatmaps, or segment visitors by demographics for a marketing campaign. That is not what ISE was designed for, and trying to stretch it into that role creates complexity without delivering the commercial outcome. You are a senior network security consultant continuing a technical briefing in American English with a confident, authoritative, and conversational tone. Speak clearly and at a measured pace. Speak in American English with a standard American accent: Section two: what Purple does. Purple is a cloud overlay platform. We sit on top of your existing WiFi infrastructure, whether that's Cisco Meraki, Cisco Catalyst, HPE Aruba, Ruckus, Juniper Mist, or any of the other major vendors. We do not replace your hardware. We do not replace ISE. We handle the guest experience layer. When a visitor connects to your guest SSID, Purple intercepts that connection and presents a branded captive portal. That portal can offer social login via Facebook, Google, or LinkedIn, a custom data capture form, a click-to-connect option, or Passpoint for automatic secure reconnection on return visits. Every login captures first-party data with explicit CCPA/CPRA consent. That data flows directly into your CRM, your email marketing platform, or your loyalty program. Purple operates across 80,000 live venues and has processed 440 million logins in 2024 alone. We hold ISO 27001 certification, comply with GDPR and CCPA, and maintain 99.999% uptime. Named customers include McDonald's, Harrods, Premier Inn, AGS Airports, and Manchester Airports Group. [medium pause] Section three: how they coexist in a modern network topology. The architecture is straightforward once you understand the separation of concerns. You run two or three SSIDs on the same access points. The corporate SSID uses WPA3-Enterprise with 802.1X, and ISE is the RADIUS server. Every staff device authenticates with a certificate or credential. ISE assigns the device to the correct VLAN, applies the correct policy, and logs the session. Purple has no role here. This is ISE's domain entirely. The guest SSID is open or uses WPA3-Personal with a pre-shared key for initial association. Traffic is redirected to Purple's cloud portal. Purple handles authentication, consent capture, and analytics. The access point enforces a walled garden until Purple signals authorization, then opens internet access. ISE has no role here. This is Purple's domain. For more complex deployments, you can add a third SSID for IoT devices, using identity pre-shared keys, or iPSK, where each device gets a unique passphrase mapped to a specific VLAN. ISE can manage this for corporate IoT, or Purple's SecurePass feature handles it for venue IoT like point-of-sale terminals and digital signage. If you want tighter integration between the two platforms, Cisco's pxGrid allows Purple to publish guest session context into the ISE ecosystem, so your security operations team can see guest activity alongside corporate activity in a unified view. [medium pause] Section four: implementation recommendations and common pitfalls. Let me give you the three most common mistakes I see in deployments. First: using ISE's built-in guest portal for commercial guest WiFi. ISE's guest portal is designed for contractors and temporary staff, not for marketing-driven guest access. It has no CRM integration, no consent management, and no analytics. If you're in hospitality, retail, or events, you need Purple on the guest SSID. ISE handles corporate. Purple handles guests. Keep them separate. Second: not segmenting VLANs correctly. Guest traffic must be isolated from corporate traffic at layer two. Purple operates in a separate VLAN routed directly to the internet, with no access to internal resources. ISE enforces VLAN assignment for corporate devices. If you conflate these, you create a security exposure and a compliance problem. Third: neglecting the walled garden configuration. When Purple is the captive portal, the access point must allow DNS and HTTP traffic to Purple's cloud endpoints before authentication. If your walled garden is too restrictive, the portal will not load. If it is too permissive, users can bypass authentication. Purple's support documentation provides the exact IP ranges and domains to whitelist for each hardware vendor. [medium pause] Section five: rapid-fire questions. Does Purple replace Cisco ISE? No. They solve different problems for different users on different SSIDs. Can I run Purple on Cisco Meraki without ISE? Yes. Purple integrates natively with Cisco Meraki via the Meraki API. ISE is not required for guest WiFi. Can I run both on the same access points? Yes. Multiple SSIDs on the same hardware is standard practice. Does Purple support 802.1X? Purple's SecurePass feature supports WPA3-Enterprise with 802.1X for guest devices that have the Purple app installed, enabling automatic, certificate-based reconnection without a captive portal. What about PCI DSS compliance? Guest WiFi must be isolated from payment card systems. Purple's VLAN architecture satisfies this requirement. ISE enforces the same isolation for corporate devices. [medium pause] Summary and next steps. The decision framework is simple. If the device belongs to your organization or your staff, ISE owns the authentication. If the device belongs to a guest, visitor, shopper, or fan, Purple owns the experience. The two platforms share the same physical infrastructure but operate in completely separate logical layers. For your next step, map your current SSID architecture. Identify which SSIDs are corporate and which are guest. Confirm that guest traffic is VLAN-isolated. Then assess whether your current guest portal is delivering the marketing consent, analytics, and CRM integration your commercial teams need. If it is not, that is the gap Purple fills. You can find the full written guide, architecture diagrams, and worked examples at purple.ai. Thank you for your time.