topic Switch location based DACL in Network Access Control

Switch location based DACL

harrzhan — Tue, 04 Sep 2018 16:28:53 GMT

Hi experts

With the variable in ISE 2.4, I can tie a name of a DACL to an attribute of an endpoint. Is there a way to tie the name of the DACL to the NAD switch location?

The goal is to implement a location based DACL. There are near 200 sites, and the DACL limit the traffic to a local site only. The easiest way to find out where the endpoint is is to use the connected switch location.

In stead of using device.location as a condition for these 200 sites, I would rather use a DACL name = Device.location in the authorization profile.

Do you have any recommendation?

Re: Switch location based DACL

paul — Tue, 04 Sep 2018 17:28:45 GMT

I haven't tested this out, but I have done something similar using a local ACL on the switches at each location. The switches would have a local ACL called "Local_Access_Only" that is customized for the location and ISE would apply the ACL to the session. So I am not applying a DACL, but applying an ACL that is on the switch.

Re: Switch location based DACL

harrzhan — Tue, 04 Sep 2018 17:33:07 GMT

Thanks for the answer. However, the number of switches is too big to make it manageable. Adding one additional line, I would have to go to all the swtiches.

Re: Switch location based DACL

paul — Tue, 04 Sep 2018 17:35:07 GMT

That can all be automated assuming you are managing the switches with any modern management software.