topic Mac-Filtering on ISE in Network Access Control

Mac-Filtering on ISE

Mady — Fri, 21 Feb 2020 18:36:41 GMT

Hi,

I created internal endpoint groups which I manually add the MAC address of user's device. The AuthZ policy I created is EndpointGroupA and SSID-GroupA = permit access.

I also have CWA portal, users who register to that portal will tag their endpoint as RegisteredDevice.

My challenge is when user with MAC addess A (example only) that is manually added to EndpointGroupA registers to CWA portal its MAC address A is now tag as RegisteredDevice.

So whenever this MAC address A access the SSID-GroupA which requires MAC-filtered device - it cannot connect to that SSID.

Hope you can help me on this. I'm thinking if there is other attribute for MAC filtering that I can use on the policy. Or any additional policy that I can configure.

Thanks in advance!

Re: Mac-Filtering on ISE

ajc — Fri, 27 Oct 2017 18:03:18 GMT

Try the attached authorization policies for CWA after the following ones:

1-if EndpointGroupA and SSID-GroupA then permit access (manual endpoint entries would get access)

2-if Network Access:UseCase EQUALS Guest Flow then permit access

***********THE ATTACHED POLICIES WOULD GO HERE*********

(the NOT EQUALS can be replaced by NOT CONTAINS

Re: Mac-Filtering on ISE

ajc — Fri, 27 Oct 2017 18:06:31 GMT

BTW, MAB authentication is not safe (spoofing can happen) unless you are ONLY allowing internet access to anyone connected to your SSIDGroupA.

Re: Mac-Filtering on ISE

Mady — Fri, 27 Oct 2017 18:10:17 GMT

thanks for your reply. I will try your suggestion. I would like to ask if is it possible to assign endpoint to two different endpoint groups for example? Because I used hotspot, self-registered and BYOD and each has different endpoint group.

there's a chance that the mac filtered endpoint connects to all of that portal and it will be tag to different group.

Re: Mac-Filtering on ISE

Mady — Fri, 27 Oct 2017 18:12:29 GMT

Yes, it has access to internet only. 🙂

Re: Mac-Filtering on ISE

ajc — Fri, 27 Oct 2017 18:18:44 GMT

no, you cannot assign an endpoint to different endpoint groups. You would have to play with the authz policies AND the Endpoint Group from the portal (see below).

Re: Mac-Filtering on ISE

Mady — Fri, 27 Oct 2017 18:24:29 GMT

🙂 thanks! it seems that I really need to work on my AuthZ policy. I will definitely try your recommendation.

Re: Mac-Filtering on ISE

ajc — Fri, 27 Oct 2017 18:27:55 GMT

do not forget to rate, thanks