topic Dynamic Variable Matching Identity Group Description in Network Access Control

Dynamic Variable Matching Identity Group Description

paul — Wed, 29 Aug 2018 15:00:52 GMT

In my installs I always allow for a whitelist called Remedate_Later that we put MAC addresses into that we can't easily figure out. This allows us to move out of Monitor mode quicker. On a larger install I want to lock the Remediate_Later concept down to sites, but I don't want to create all the corresponding MAB rules. I am trying to get dynamic variable matching to work.

So I have endpoint identity groups configured as Remediate_Later_<Site Name> and I put the site code in the description field, i.e. Site1. All the network devices names at the site start with Site1.

In my dynamic variable match I say:

Network Access:network device name starts with Identity Group:description

I can make that condition but it doesn't seem to work. I can see in the step data that the PIPs are being queried. I can't use other fields like device location or identity group name because they contain the full path the object, i.e. Identity Groups:Whitelists:Remediate_Later:Remedidate_Later_<Site Name> or All Locations#<Site Name>.

I was hoping the description field would be coded straight up as the string I put in. Should this work? I am guessing no one in Dev ever thought of this use case.

Any other ideas to accomplish without righting 100s of MAB rules.

Re: Dynamic Variable Matching Identity Group Description

hslai — Sat, 01 Sep 2018 21:30:04 GMT

Identity Group:description does not appear fetching its value at all.

Instead, it's working ok with an endpoint attribute:

Network Access·NetworkDeviceName Starts With EndPoints·assetTag

Re: Dynamic Variable Matching Identity Group Description

paul — Fri, 07 Sep 2018 13:52:34 GMT

Hsing,

I just got around to testing this today. I created a custom endpoint attribute called Asset-Location. I then put the location name in that field. I was then able to match "Network Device:Location contains Endpoint:Asset-Location". Thanks for the solution.

Now when I put my endpoints into my whitelist I can lock them into a particular location without having to create a bunch of rules.