topic Re: 802.1X AND MAC address Authentication simultaneously? in Network Access Control

802.1X AND MAC address Authentication simultaneously?

JDores — Fri, 22 Dec 2017 18:32:23 GMT

Hi experts,

I have a customer that wants to understand if we can authentication a user using both 802.1X AND Mac address authentication at the same time, i.e., not only make sure the user/pass is correct but that the MAC address of his device should be granted access.

Does the 802.1X RADIUS Message to ISE also include the MAC Address of the device so that we can also use that MAC Address as an additional layer of compliance to grant access?

Thanks in advance,

José

Re: 802.1X AND MAC address Authentication simultaneously?

Jason Kunst — Fri, 22 Dec 2017 18:38:46 GMT

Yes you would setup an authorization policy with a basic rule

If AllowedEndpoints and dot1x then permit access

Re: 802.1X AND MAC address Authentication simultaneously?

Craig Hyps — Fri, 22 Dec 2017 18:44:25 GMT

To clarify and expand on comments to internal post, there is only one authentication (802.1X) in this scenario. As Jason noted, you can also validate the Calling-Station-Id (MAC address of LAN user) to an allowed list such as Endpoint Identity Group with specific permissions.

Re: 802.1X AND MAC address Authentication simultaneously?

JDores — Fri, 22 Dec 2017 18:46:41 GMT

Great, thank you both for your quick replies!

Re: 802.1X AND MAC address Authentication simultaneously?

gbekmezi-DD — Fri, 22 Dec 2017 21:14:18 GMT

This is assuming you have a system (import or API) to add endpoints and assign them to identity groups in place.