topic Re: Add New MAC Address for MAB on Identity Groups in Network Access Control

Add New MAC Address for MAB on Identity Groups

fdharmawan — Tue, 16 Oct 2018 03:06:03 GMT

Hi Guys,

I want to add new MAC address to Endpoint Identity Groups to my ISE, so my IP phone can bypass dot1x authentication process via MAB. The thing is, I was unable to add the new MAC address since it is not on the available list, even though the IP phone is already connected to the network for more than 1 month. And I could not find a way to add that MAC address to the list. Is there any way I can add MAC address so it can be found on the list?

I found a workaround by connecting the IP phone to a port where dot1x is active. This way, the MAC can be found on the list because it was challenged for authentication. But I find it is not practical since I have hundreds of IP phone to be registered.

Thank you.

Re: Add New MAC Address for MAB on Identity Groups

Damien Miller — Tue, 16 Oct 2018 03:22:47 GMT

Replied to your other thread with the screenshot.
https://community.cisco.com/t5/identity-services-engine-ise/add-new-mac-address-for-mab-on-identity-groups/m-p/3725941

Re: Add New MAC Address for MAB on Identity Groups

Francesco Molino — Tue, 16 Oct 2018 04:12:12 GMT

Hi

You can add a new mac address by going on menu workcenter/Network Access/Identity.

On the table at the bottom, click the + sign and add the new mac address, and select the right group policy for him by selecting assign static policy.

You can also import a csv if you have multiple mac addresses to add.

Re: Add New MAC Address for MAB on Identity Groups

fdharmawan — Tue, 16 Oct 2018 05:12:53 GMT

Hi Francesco,

I already obtained the csv template and got the example csv file from ISE. Correct me if I'm wrong, but not all the columns should be filled right? Even if it is filled from the exported file. From my observation, I only need to fill these fields: MACAddress, IdentityGroup, AuthorizationPolicyMatchedRule, SelectedAuthorizationProfiles, StaticAssignment, and StaticGroupAssignment. Do I miss something?

And after the csv file is good to go, I need to import the file to the ISE from Work Centers -> Network Access -> Identities -> Import -> Import From File -> Submit. Is this correct?

Thank you.

Re: Add New MAC Address for MAB on Identity Groups

Aravind Ravichandran — Tue, 16 Oct 2018 08:26:22 GMT

Hi,

In your case, just two fields : MacAddress(eg: 00:00:00:00:00:00) & IdentityGroup (eg: IP Phone), Please don't delete any columns.

you can import the file to ISE on this path Context visibility->Endpoints->Import->Import from file->Choose the file->Submit->Ok

Re: Add New MAC Address for MAB on Identity Groups

fdharmawan — Tue, 16 Oct 2018 08:47:38 GMT

Hi Aravind,

Thanks for the help. Cheers.