topic Re: ISE 2.6 where to put mac addresses in Network Access Control

ISE 2.6 where to put mac addresses

as00001111 — Mon, 04 May 2020 11:48:23 GMT

Hi guys,

right now we are using ACS 5.8 for dot1x and mab.

I want to replace acs with ise 2.6

in acs -> Users and Identity Stores -> Internal Identity Stores -> Users are all mac addresses for mab. all mac addresses are manually added.

Where can I add those mac addresses in ISE?

Thank you!

Re: ISE 2.6 where to put mac addresses

Mike.Cifelli — Mon, 04 May 2020 11:56:16 GMT

In ISE you manage internal endpoint identity groups here: Administration->Identity Management->Groups->Endpoint Identity Groups. You also have the ability to rely on adding them via REST APIs or via context visibility->endpoints (add). HTH!

Re: ISE 2.6 where to put mac addresses

Surendra — Mon, 04 May 2020 13:37:20 GMT

You can add them under Context Visibility > Endpoints.

Re: ISE 2.6 where to put mac addresses

Mike.Cifelli — Mon, 04 May 2020 14:07:59 GMT

Here is a quick script you can use for new endpoint bulk adds. Note that this script will not work for existing MACs in ISE db, you will need to identify your unique group id and update url and user/pass info:

#!/usr/bin/python
import requests
import warnings

#ignore invalid cert warnings
warnings.filterwarnings("ignore")

maclist = open('MAC.txt','r')
address = maclist.readlines()

for mac in address:
    API_DEVICE = "https://<your ise pan>:9060/ers/config/endpoint/"
    API_ERS_USER = "<user>","<password>"
    API_DATA = ({
        "ERSEndPoint" : {
        "name" : "Workstation",
        "mac" : mac,
        "staticGroupAssignment" : "true",
        "groupId" : "a1649530-6840-11e9-aa97-0242f38bcc8a",
        }
    }
)
    r = requests.post(url=API_DEVICE, auth=API_ERS_USER, verify=True, json=API_DATA)
    print r.reason

Finding unique group ip:

$ curl -k --include --header 'Content-Type:application/json' --header 'Accept: application/json' --user <user>:<pass> --request GET https://<ise pan ip>:9060/ers/config/endpointgroup?filter=name.EQ.<your endpoint group name>

Response will look like:

{
    "SearchResult" : {
        "total" : 1,
        "resources" : [ {
            "id" : "a1649530-6840-11e9-aa97-0242f38bcc8a",
            "name" : "<your group id>",
            "description" : "xxxx",
            "link" : {
                "rel" : "self",
                "href" : "https://<ise pan ip>:9060/ers/config/endpointgroup/a1649530-6840-11e9-aa97-0242f38bcc8a",
                "type" : "application/json"
            }
        } ]
    }
}

HTH & Good luck!

Re: ISE 2.6 where to put mac addresses

as00001111 — Wed, 06 May 2020 09:51:41 GMT

Hi!

I had an ISE training 6 months ago and the instructor told us that adding mac addresses is not that easy.

First of all, a new device must be connected to the network in order to appear in the endpoint visibility context.

After that, you can add the mac address since ISE knows it.

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?

Re: ISE 2.6 where to put mac addresses

as00001111 — Wed, 06 May 2020 09:52:45 GMT

Hi!

I had an ISE training 6 months ago and the instructor told us that adding mac addresses is not that easy.

First of all, a new device must be connected to the network in order to appear in the endpoint visibility context.

After that, you can add the mac address since ISE knows it.

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?

Re: ISE 2.6 where to put mac addresses

paul — Wed, 06 May 2020 11:29:21 GMT

As people have said there are several places to add MAC addresses into ISE. When I am educating customers on ISE I always refer them to Context Visibility->Endpoints. This screen allows you to easily import from a CSV and will provide you a template. In addition if you are adding a single MAC address or editing an existing MAC address it is the only screen I know of that allows the description value to be input. This is key for self-documenting MAC addresses and why they were added to a particular whitelist.

Re: ISE 2.6 where to put mac addresses

Mike.Cifelli — Wed, 06 May 2020 12:36:18 GMT

But I'm looking for a possibility to add mac addresses beforehand. manually. Is that possible?
-As three of us have mentioned, Yes absolutely. When adding new endpoints I personally prefer the rest api way. However, there are easier ways. Both of which include the bulk csv @paul mentioned and then the manual one-by-one way under context visibility. There you can add the MACs and statically assign them to groups and/or a specific profile policy so that way when they get on the network you can already have policies setup to support them. HTH!

Re: ISE 2.6 where to put mac addresses

thomas — Tue, 12 May 2020 00:57:09 GMT

Your instructor was wrong.

You can add them under the Context Visibility > Endpoints menu as many people have said.

Use the + :

or CSV Import option:

Use the attached CSV file as an example if you like.

When you add them manually, you simply will not have any IP address or authentication information for them (yet):