topic MAB, ISE, and AD in Network Access Control

MAB, ISE, and AD

Dustin Anderson — Mon, 24 Sep 2018 18:35:20 GMT

So, I've been looking and have not found anything specific.

So, they are trying to add devices into AD using ieee802Device. Now, what I can't find other than mentions of this is if ISE can validate by these.

They set up a group I pulled into ISE, and added a device into the group. It fails with auth failed.

Can this be done, or does the device have to be a user account and not the ieee802Device?

Re: MAB, ISE, and AD

umahar — Mon, 24 Sep 2018 20:09:25 GMT

Could you clarify your question again ?

Do you want to authenticate MAB endpoints via AD on ISE ?

I have a customer who is doing this using LDAP and placing different endpoints (profiles) in different OU on AD

Re: MAB, ISE, and AD

Dustin Anderson — Tue, 25 Sep 2018 14:33:44 GMT

We want to use AD and assign vlans based on groups. APs, thermal printers, laser printers etc.

I think the issue is they want to use the new Devices instead of user accounts, and I don't think ISE supports this way?

Re: MAB, ISE, and AD

umahar — Tue, 25 Sep 2018 14:44:27 GMT

If I understand correctly you want to whitelist MAB devices on AD instead of ISE itself.

Not very common but can be achieved.

Re: MAB, ISE, and AD

Jason Kunst — Tue, 25 Sep 2018 15:04:44 GMT

Something like this?

I googled mab ise ldap

https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/trustsec/whitepaper_C11-717280.html

Re: MAB, ISE, and AD

Dustin Anderson — Tue, 25 Sep 2018 17:01:17 GMT

The reason they don't want to do ISE profiling is we really don't trust it to profile correctly. Right now the AP next to me is profiling as a Cisco Switch. They also would like to not have to buy 3000+ licenses for all these printers.

Jason, we tried that, and I guess i'm not sure if the failure is on ISE, or theme not setting up AD correctly for what we are doing.

Re: MAB, ISE, and AD

umahar — Thu, 27 Sep 2018 13:28:48 GMT

Yes.

Each group then can whitelist their owned devices on AD using their credentials to get them into the network.

Re: MAB, ISE, and AD

Jason Kunst — Thu, 27 Sep 2018 15:01:04 GMT

Troubleshoot with TAC then?