https://community.cisco.com/t5/network-access-control/ise-sandbox/m-p/3568084#M520165 <HTML><HEAD></HEAD><BODY><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;">Hi Team, <BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;"><BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;">In Windows browser (<A href="https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/">https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/</A>) there is a sandbox.&nbsp; It creates a different TCP stack on Windows machine, and this is causing problems with ISE - ISE it treating this “sandbox” as separate machine and is trying to authenticate it. Do we have any solution for such scenario?</SPAN></P><P style="font-size: 13.3333px;"></P><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;">I got this answer from Hsing-Tsu, but maybe we have a strategy for this challenge :</SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><SPAN style="font-size: 10pt;">"It seems this MS Edge sandbox app container has its own MAC address so ISE considers it as a separate endpoint. As it not capable of DOT1X, MAB is the only thing I can think of. If it associated with some particular OUI or MAC address pattern, we may profile and put such into some particular endpoint profile and/or endpoint group and </SPAN>authorize<SPAN style="font-size: 10pt;"> them accordingly. " </SPAN></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;">Thank you!</SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;">Best regards, Gyorgy<BR /></SPAN></P></BODY></HTML> Mon, 06 Nov 2017 09:20:00 GMT gacs 2017-11-06T09:20:00Z https://community.cisco.com/t5/network-access-control/ise-sandbox/m-p/3568084#M520165 <HTML><HEAD></HEAD><BODY><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;">Hi Team, <BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;"><BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;">In Windows browser (<A href="https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/">https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/</A>) there is a sandbox.&nbsp; It creates a different TCP stack on Windows machine, and this is causing problems with ISE - ISE it treating this “sandbox” as separate machine and is trying to authenticate it. Do we have any solution for such scenario?</SPAN></P><P style="font-size: 13.3333px;"></P><P style="font-size: 13.3333px;"><SPAN style="font-size: 10pt;">I got this answer from Hsing-Tsu, but maybe we have a strategy for this challenge :</SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><SPAN style="font-size: 10pt;">"It seems this MS Edge sandbox app container has its own MAC address so ISE considers it as a separate endpoint. As it not capable of DOT1X, MAB is the only thing I can think of. If it associated with some particular OUI or MAC address pattern, we may profile and put such into some particular endpoint profile and/or endpoint group and </SPAN>authorize<SPAN style="font-size: 10pt;"> them accordingly. " </SPAN></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;">Thank you!</SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"><BR /></SPAN></P><P style="font-size: 13.3333px;"><SPAN style="color: #58585b; font-size: 10pt; font-family: 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;">Best regards, Gyorgy<BR /></SPAN></P></BODY></HTML> Mon, 06 Nov 2017 09:20:00 GMT https://community.cisco.com/t5/network-access-control/ise-sandbox/m-p/3568084#M520165 gacs 2017-11-06T09:20:00Z https://community.cisco.com/t5/network-access-control/ise-sandbox/m-p/3568085#M520166 <HTML><HEAD></HEAD><BODY><P>Gyorgy, can you elaborate on the issue? So when user opens up a edge browser, does it initiate a MAB?</P></BODY></HTML> Mon, 06 Nov 2017 22:11:04 GMT https://community.cisco.com/t5/network-access-control/ise-sandbox/m-p/3568085#M520166 howon 2017-11-06T22:11:04Z