topic Re: ISE with ip source-guard in Network Access Control

ISE with ip source-guard

jaosgood — Thu, 30 Jun 2016 19:15:26 GMT

Are there are best practices around using ISE with source-guard, since source-guard will apply a port ACL, what do we recommend in terms of deployment in these cases?

Re: ISE with ip source-guard

hslai — Sun, 03 Jul 2016 20:49:28 GMT

IP Source Guard is a security feature on Cisco IOS switches but not on ISE so you should consult with the support and product teams on Cisco IOS switch platforms. There is no report on its conflicting with DOT1X so it should be safe to use.

IP source guard without DHCP - PacketLife.net shows it requires DHCP snooping enabled for static IP addresses.

Re: ISE with ip source-guard

hasitha siriwardhana — Thu, 18 Apr 2019 06:47:51 GMT

Hi Hsai,

To stop mac spoofing normally recommendation is to enable Dynamic Arp inspection and IP source guard.

1)Will there be any issue to function ISE with dot1x ,if we enable above DAI and source guard.

2) Do we really need to enable DAI and Source guard ,in a ISE enabled environment. Can't ISE itself detect mac spoofing