topic Re: ISE guest access controlled by MAC address in Network Access Control

ISE guest access controlled by MAC address

osw200051 — Fri, 21 Feb 2020 18:52:32 GMT

Hi Expert,

I have a problem, we have wifi guest and wifi internal network. but i found that many of our internal usage use the guest wifi rather than internal wifi since the internal wifi block some web page.

On this moment, i have our internal user's device Mac address only. Can I control on guest wifi that if the mac address match the list (internal's device list), then this device cannot access the guest network? Can ISE do that?

thanks

Re: ISE guest access controlled by MAC address

Francesco Molino — Mon, 02 Apr 2018 03:34:30 GMT

Do you have a group containing all your internal hosts mac addresses?

If so, you can duplicate the guest rule internal hosts are hitting above it and add your internal mac addresses group as condition and switch the rule as denied instead of permit.

Re: ISE guest access controlled by MAC address

osw200051 — Thu, 05 Apr 2018 08:58:07 GMT

Hi Francesco,

Very happy for see your reply that can help me.
Your suggestion can be done on ISE?

Thanks

Re: ISE guest access controlled by MAC address

Francesco Molino — Fri, 06 Apr 2018 04:02:47 GMT

Yes you can do that on ise.
You need to create at the top a rule saying your mac group containing all your internal hosts + your wlan id = deny.
Instead of wlan id you can also use normalisedradius contains ssidname

Re: ISE guest access controlled by MAC address

ajc — Fri, 06 Apr 2018 14:17:48 GMT

What version are you running?.

I have seen endpoint group value being modified after successful or failed authentication so even though you have the internal MAC addresses in an specific endpoint group, that value could change to Unknown, Blank or Profiled so they would eventually be authenticated using again the Guest SSID because you would not hit the new Authz policy for internal users.

I am assuming you have a guest network with only an AUP page or similar, no authentication. I would suggest you to evaluate modifying that to something like webauth so you can actually control who get access to that SSID.