Interface templates in data center?

kerai08 — Tue, 21 Nov 2017 16:43:37 GMT

Hi team,

Customer has a requirement to stop people plugging into switches/servers with their laptop etc in the data center.

Customer currently uses ISE in branch locations with MAB (no dot1x). The requirement is less about authenticating users but more stopping anyone plugging in (there a physical controls like biometrics to get past) with a more centralised way of controlling the policy rather than things like port security (sticky MAC etc) as it's a higher administrative overhead.

Questions:

1. What would be a recommended way to lock down ports in a data center environment? Is ISE in the data center overkill here?

2. Will service or interface templates be something they could use here?

3. What do we at Cisco use in our DC environment?

Appreciate your thoughts.

Thanks,

Arron

Re: Interface templates in data center?

hariholla — Wed, 22 Nov 2017 00:20:29 GMT

Hi Arron,

Typically DC environments are secured physically, so this requirement doesn’t arise with many of our customers. We do support 802.1X on some of our DC switches, but that isn’t officially validated with ISE. For ISE to be able to deny unauthorized access, some sort of authentication is necessary. I suggest you consult the DC engineers get tips on how to do it with some sort of DC managers like DCNM or APIC controller.

~Hari

topic Re: Interface templates in data center? in Network Access Control

Interface templates in data center?

Re: Interface templates in data center?