topic Re: ISE and MAB for printers in Network Access Control

ISE and MAB for printers

Ilnur.Garipov — Fri, 21 Feb 2020 18:53:05 GMT

Hi, everyone!

Has anyone set up MAB for ise-2.3 for printers, having a list of the mac-addresses of these printers?

Please tell me how to do it.

Thanks!

Re: ISE and MAB for printers

Mohammed al Baqari — Mon, 09 Apr 2018 07:43:02 GMT

What are you looking for exactly?

Re: ISE and MAB for printers

Ilnur.Garipov — Mon, 09 Apr 2018 07:58:18 GMT

There are domain PCs, IP telephones and printers in my network. So, I know how to set up dot1x for domain PCs, but I don’t know how to configure MAB for printers and ip telephones so that domain users can print and make calls.

Re: ISE and MAB for printers

Mohammed al Baqari — Mon, 09 Apr 2018 08:06:02 GMT

that's pretty straight forward. Enable 'mab' under the interfaces. Then in
ISE configure authorization policy to match Wired_MAB _ Cisco IP Phones and
grant it access in the result.

For printers you have two options:

1. Let them connect for 1st time get profiled and if you use standard
vendor then you can add authorization policy to match the vendor profile
and allow acess
2. Option 2 is to create end point identity group and add the mac addresses
statically to it. Then create authorization policy to match this group and
grant access

Re: ISE and MAB for printers

Ilnur.Garipov — Mon, 09 Apr 2018 10:40:40 GMT

Thank you for your advice!

If I have non-cisco phone the second option will be work for this devices?

Re: ISE and MAB for printers

Mohammed al Baqari — Mon, 09 Apr 2018 11:02:01 GMT

There is a precreated condition for non-cisco phones

Re: ISE and MAB for printers

johnywalker — Tue, 23 Oct 2018 08:45:06 GMT

I have a doubt here.

Is there any other options available to do authorization of printer which don't have any domain credentials ? other than mab and profile attributes ? combination of mab + serial number + and other for authorization ?

Is it possible to do a posture assessment for printer to check the firmware version ?

Is it possible to do a posture assessment for machine which running with AIX operating system ?

Re: ISE and MAB for printers

fiza258 — Wed, 24 Aug 2022 17:47:27 GMT

I have a question to do the second option, it's only necessary to have an Essential License for each device?

Regards,

Fabian Iza

Re: ISE and MAB for printers

Arne Bier — Wed, 24 Aug 2022 20:06:02 GMT

“Posture assessment” on printers would not be the same as posture assessment on operating systems such as Windows/Mac etc because we cannot execute code on those devices. But you can profile a printer and I think SNMP might provide the answer. Profiled authorisations will consume 1 Advantage license.