topic Re: Send interface description to ISE. in Network Access Control

Send interface description to ISE.

Mon, 11 Mar 2019 07:53:18 GMT

Hi,

Does anyone know if it is possible to send an interface description to ISE as part of the RADIUS access request?

The interface ID is included in various elements e.g. 'nas-port-id' and 'cisco-nas-port', but not the description.

Intent would be to 'tag' an interface for a special use-case, and ISE would match this to apply specific policy.

Cheers.

Hi,

Aditya Ganjoo — Tue, 25 Jul 2017 04:36:52 GMT

Hi,

There is a feature called "Vlan-ID based MAC authentication" that is available only for MAB authentication.

Using this we can send the Vlan id to Radius Server but not in attribute 81 but attribute 32.

Thanks Aditya.

Tue, 25 Jul 2017 10:51:24 GMT

Thanks Aditya.

This is a great suggestion however ideally we would want to use something that doesn't have an operational impact.

We use standardised interface configurations with the same access VLAN across our environment.

In order to stage changes, it would be ideal if for example we could tag multiple interfaces locally, and have ISE apply policy based on this.

Currently we use a match on network device and interface, but this gets complicated for more than a few interfaces.

So rather than:

IF switch X interface A OR switch X interface B OR switch Y interface A THEN test_policy

we use something like :

IF interface_tag THEN test_policy

Say we were testing a specific DACL, we wouldn't necessarily want to modify the access VLAN, as it wouldn't be representative of the final setup.

To me the requirement is similar to VLAN-ID based MAC authentication, in that we are sending information from the locally configured interface, just rather than VLAN ID it is another attribute, e.g. interface description.

Hopefully I've explained in a concise manner, but if you have questions please let me know.

Cheers.

Re: Send interface description to ISE.

Joshua Robertson — Fri, 30 Mar 2018 16:25:46 GMT

I had a similar requirement from a customer (tag certain ports to be treated differently), and I was able to utilize the NAS-Port-Type attribute to send a Port-Type other than Ethernet and filter on the new type being sent for those ports. Not ideal, but may be a usable workaround for you. On the switch port, configure with 'radius attribute nas-port-type <type id>'.

https://www.iana.org/assignments/radius-types/radius-types.xhtml#radius-types-13