topic Re: Device Identification over the Internet using ISE in Network Access Control

Device Identification over the Internet using ISE

Terence Lockette — Mon, 04 Jan 2021 20:06:14 GMT

Hello all,

I had a series of questions come my way regarding the profiling of devices that communicates to our internal/DMZ network either over the Internet or VPN tunnels. It is my understanding that ISE will only profile devices directly attached to our internal network as there are some configs that needs to be added to switches in order to ensure the necessary probes being used can profile the device appropriately.

Question: Is it possible to use ISE to also profile a device coming from an external network, such as the Internet or VPN tunnel, for the sole purpose of simply identifying (device type & IP address) that device for security purposes?

My thinking is along the lines of how some Internet apps may use your device type to identify if you've ever logged into their service from that device before OR may send you a notification if a login was detected from a specific device that may be a security alert.

Thanks in advance!

Terence

Re: Device Identification over the Internet using ISE

yalbikaw — Tue, 05 Jan 2021 09:08:48 GMT

all depends on the attributes that are being sent along with the authentication, so if vpn user is authenticated with ISE and the firewall sends the accounting, this accounting packets usually contains mdm-tlv attributes that can be used for profiling the endpoint

Re: Device Identification over the Internet using ISE

Panos Bouras — Tue, 05 Jan 2021 13:23:27 GMT

Hi,

You can collect values for your VPN users via Anyconnect ACIDex, but there are limited on ISE.

Check the following presentation

https://www.ciscolive.com/c/dam/r/ciscolive/apjc/docs/2019/pdf/BRKSEC-2725.pdf

Re: Device Identification over the Internet using ISE

Terence Lockette — Tue, 05 Jan 2021 13:25:44 GMT

Thanks for your reply. I should've been clearer in my original post. I'm referring to external devices that do not belong to our network coming across an external network such as the Internet or IPsec VPNs. For instance, a vendor has a VPN tunnel set up to communicate with our internal servers, can ISE be used to identify the device attempting to talk to our server? Or, an employee using their personal device to connect to a server over the Internet in our DMZ. Can ISE be used to identify this device?