topic Re: profiled endpoint group based on location in Network Access Control

profiled endpoint group based on location

barawlin — Wed, 05 Jul 2017 16:28:56 GMT

Is it possible to place a profiled endpoint into a group based on where it was learned?

For example, if a Printer was seen and profiled when attached to switch X, place it in the "Known Printers" endpoint group, which an Authorization Policy can reference. This will prevent just *any* printer from being allowed on the network via MAB if the Authentication Policy only references "internal endpoints" and there is no catch-all Authorization Policy to deny access.

Re: profiled endpoint group based on location

howon — Wed, 05 Jul 2017 16:40:25 GMT

Yes, you could use RADIUS:NASID to identify the switch you initially connected to then use profiling exception action to statically assign it to an endpoint group.

Re: profiled endpoint group based on location

Craig Hyps — Thu, 06 Jul 2017 13:33:23 GMT

For groups of NADs, recommend assign them to NDG. You can then use NDG in Profile Condition.