topic Re: Creating device policies in Network Access Control

Creating device policies

Areyesibarra — Wed, 13 Sep 2017 23:06:33 GMT

Friends, I want to create policies so that certain devices can not connect to a specific SSID. For example that the devices android, apple can not connect but if devices with S.O windows in all its version. The policies I want to create on the ISE 2.2 server. Currently these policies are configured in my controller 2504 in local policies.

Please support them.

Thank you.

Re: Creating device policies

Arne Bier — Wed, 13 Sep 2017 23:19:15 GMT

Alejandro

How do you currently do that in your 2504 controller?

In ISE I would imagine that you should do this via device profiling (Profiling requires a PLUS license on top of BASE license) - the profiler would look at multiple attributes of the device to build a "certainty factor" that you have profiled the device correctly.

If you wanted to do this based on the OUI (Manufacturer MAC address prefix) then you might be able to filter out the majority of devices, but it would take effort, because Android comes in many flavours.

Re: Creating device policies

hslai — Thu, 14 Sep 2017 00:56:44 GMT

Adding to Arne's... Please review "Profiling and Authorization Policy" section inHow To: ISE Profiling Design Guide, which starts at page 118.

In case your inquiry is more towards AVC, please go over Application Visibility and Control Feature Deployment Guide and then consult the support resources at Wireless if you have further question on that.

Re: Creating device policies

Areyesibarra — Thu, 14 Sep 2017 17:05:06 GMT

Thanks for your comments.

Currently the policies are in the driver.

I will follow the documentation and advice provided, I hope everything goes well.

Re: Creating device policies

Areyesibarra — Mon, 18 Sep 2017 14:22:36 GMT

Good morning friends.

Thank you for the contributions and advice, the inconvenience and solve it.