topic Re: Mac-Address Different format for Authorization on Cisco ISE in Network Access Control

Mac-Address Different format for Authorization on Cisco ISE

arikawahyono — Mon, 11 Mar 2019 03:41:56 GMT

Dear All,

I have problem with my Cisco ISE,

This is the design :

ISE ---- Core Switch ---- 3Com Switch --- PC User

My Case:

Authorization is based on Mac-address and Active Directory,

But user with PC that connect to 3Com swtich is Deny by ISE because the Format Mac-address is different with Cisco,

Mac-address Cisco format : XX:XX:XX:XX:XX:XX

Mac-address 3Com format : XXXX-XXXX-XXXX

3Com Switch type is TRICOM 4210 26-PORT.

Anyone have experience with this? and how change the mac-address format in 3Com so user can authorized by Cisco ISE.

note:

authorization based on Active Directory is not problem with 3Com Switch.

Based on my experience, Different product is different format mac-address, so this case not only for 3Com Switch.

Thanks,

Arika Wahyono

Mac-Address Different format for Authorization on Cisco ISE

Eduardo Aliaga — Mon, 29 Jul 2013 04:54:50 GMT

Hello. Authentication using "Mac address bypass" is not a standard feature. Every vendor does it differently. I don't think this could work, but even if this can be done the solution won't be realiable because it's not standard based.

Re:Mac-Address Different format for Authorization on Cisco ISE

Tarik Admani — Mon, 29 Jul 2013 07:15:33 GMT

Hi,

Please check the ise 1.2 release notes for support for mab with non cisco switches. Seems as if some functionality has been added.

http://www.cisco.com/en/US/docs/security/ise/1.2/release_notes/ise12_rn.html#wp354890

Sent from Cisco Technical Support Android App

Mac-Address Different format for Authorization on Cisco ISE

arikawahyono — Mon, 29 Jul 2013 07:53:11 GMT

Dear Tarik,

Are you sure with ise 1.2 my case will solved?

my current ISE is 1.1.2.145.

Thanks,

Arik

Mac-Address Different format for Authorization on Cisco ISE

Ravi Singh — Mon, 29 Jul 2013 09:11:46 GMT

Not sure because it is not listed in compatibility matrix list.

Mac-Address Different format for Authorization on Cisco ISE

arikawahyono — Mon, 29 Jul 2013 09:17:19 GMT

Ravi,

Can you show me the compability matrix list?

Thanks,

Re: Mac-Address Different format for Authorization on Cisco ISE

Ravi Singh — Mon, 29 Jul 2013 09:19:19 GMT

Please find the attached Compatibility list

Mac-Address Different format for Authorization on Cisco ISE

Tarik Admani — Mon, 29 Jul 2013 14:36:24 GMT

I do not think Cisco will add these vendors to the supported switch matrix because then it would be a support issue that cisco would have to deal with, much like most of the AD issues I experienced when I worked in TAC. Your best bet would be to run the evaluation license instance in a lab and have a 3com switch point against that.

Other than that I do not recommend upgrading to 1.2 without validating that the new "multi-vendor" MAB support will work on your switch.

PS- Keep in mind that my comments is just my opinion so you may need to open a TAC case for an official answer.

Tarik Admani
*Please rate helpful posts*

Re: Mac-Address Different format for Authorization on Cisco ISE

Ravi Singh — Fri, 20 Sep 2013 04:12:55 GMT

Please find the attached Compatibility list