topic Re: can i disable auto discovery endpoints in ISE ? in Network Access Control

can i disable auto discovery endpoints in ISE ?

sbmc014 — Wed, 23 May 2018 07:27:24 GMT

when i connect my laptop on switch in ISE environment , it will be auto discovery via ISE , and list in Home-->summary-->total endpoints :

and put this MAC entry in table :

When i test 802.1x MACauth via ISE , it always pass due to this MAC existed , any possible i can disable auto discovery endpoints MAC function ? ISE version is 2.4.0

Re: can i disable auto discovery endpoints in ISE ?

ognyan.totev — Wed, 23 May 2018 08:02:16 GMT

When you connect to the switch and start radius session ISE will learn the mac address. How you configured the switch

there maybe SNMP configuration too it can learn the mac address from there too.And i think it is necessary all of this for profiling in ISE . And it will not passes if your rules are configured correctly .

Re: can i disable auto discovery endpoints in ISE ?

sbmc014 — Wed, 23 May 2018 08:19:29 GMT

thanks for your reply , can you give me some advise for how to setting correct configration for MAC auth via

Re: can i disable auto discovery endpoints in ISE ?

ognyan.totev — Wed, 23 May 2018 08:38:12 GMT

First explain what you want to do ? Show us switch configuration ,show how you create policy ,Authentication and authorization .

Re: can i disable auto discovery endpoints in ISE ?

sbmc014 — Wed, 23 May 2018 10:35:56 GMT

thanks for your reply , my laptop MAC will be auto discovery in unknown list :

and MAC-auth will pass if this MAC existed on this table , and i cannot remove it manually .

Authentication policy like this :

authorization policy like this :

in my opinion , it should some table that i can maintain (keyin MACs that want to authenticated ) , but i cannot find where is it ? Or other configurations i need to adjust ?

Re: can i disable auto discovery endpoints in ISE ?

ognyan.totev — Wed, 23 May 2018 10:41:46 GMT

Yes i am pretty sure it hits basic network access ,first of all disconnect your laptop from switch second delete endpoint mac address from context visibility ,than reconnect your laptop to switch and see what happen .I never use this rule and in mine deployment i disable it .I prefer mine rules nor default ones.

Re: can i disable auto discovery endpoints in ISE ?

Craig Hyps — Wed, 23 May 2018 11:18:25 GMT

You cannot disable the discovery, but if goal is to only allow access to endpoints explicitly assigned to an access group, then you can go to Administration > Identity Management > Groups > Endpoint Identity Groups to add, import (via file/LDAP) MAD addresses into the desired group for policy assignment. You can also use ERS API to update the endpointd and group memberships.

Note that an given MAC address can belong to only one Endpoint Identity Group at a time, so may be worth looking into Custom Attributes if wish endpoints to belong to multiple classifications for policy assignment.

Re: can i disable auto discovery endpoints in ISE ?

sbmc014 — Thu, 24 May 2018 06:38:27 GMT

thanks for your reply , after i checked logs , endpoint profile is "unknown" , and everytime PC/NB connect on this environment , the MAC will auto discovery and list on this profile :

may i adjust it to another profile ? like "workstation" or "profiled" , if yes , where is configuration i should modify ?

Re: can i disable auto discovery endpoints in ISE ?

Jason Kunst — Thu, 24 May 2018 11:16:59 GMT

No you cannot

Would recommend if you’re so concerned with this you disable default authorization rule for authenticated that comes on out of box

Recommendation is to authenticate all but then put an authorization for those you don’t want to allow that redirects them to a portal page with insurrections and gives them limited access

Then only authorize with more access those groups you have built manually perhaps?

If valid group then permit access full?

Re: can i disable auto discovery endpoints in ISE ?

Craig Hyps — Thu, 24 May 2018 12:43:36 GMT

In the absence of an explicit ID group assignment, endpoints will have a default ID Group assigned based on its profile status. If end does not match a known profile, it is assigned a group of Unknown. If it matches a known profile, it is assigned a group of Profiled. If enable profile to "Create Matching Identity Group", it will then be assigned to an Identity Group based on Profile name.

In your case, if wish these endpoints to be granted or denied access, then assign them to a specific ID group and ignore profile.

Craig