topic IP to SGT Mapping Question in Network Access Control

IP to SGT Mapping Question

edmcnich — Tue, 18 Dec 2018 21:15:10 GMT

I have a customer that has 802.1x to ISE configured on his Meraki MS switches. They also have SXP configured between ISE and an upstream ISR router. They would like to configure SGACLs on the ISRs using the dynamically configured SGTs assigned in ISE, and publish these SGTs to the ISR router (SXP Listerner).

I guess the question is, can ISE create dynamic IP to SGT mapping using 802.1x from Meraki (not SXP speaker, because Meraki doesn't support it), and publish to an ISR via SXP?

Re: IP to SGT Mapping Question

umahar — Tue, 18 Dec 2018 22:57:44 GMT

In general this is supported, havn't actually integrated with Meraki.

If ISE is the one tagging 802.1x endpoints on Meraki then this should be possible.

Be sure to enable the below setting. This should populate the IP-SGT bindings on ISE with dynamic tags for radius sessions.

Re: IP to SGT Mapping Question

gbekmezi-DD — Wed, 19 Dec 2018 18:24:13 GMT

This should work. You assign the SGT in the authorization result and it should get added to the internal mapping in ISE, which should then get propagated to SXP clients.