topic Re: Authentication host-mode multi-auth in Network Access Control

Authentication host-mode multi-auth

Pete C — Tue, 26 Jan 2021 18:33:22 GMT

if you configure AUTHENTICATION HOST-MODE MULTI-AUTH on your switch port allowing a single device in the voice domain and multiple devices on the data domain, is it possible to limit the number of devices on the data domain. For example, a single phone and 2 devices but not 3.

thanks

Re: Authentication host-mode multi-auth

Marcelo Morais — Tue, 26 Jan 2021 19:38:15 GMT

Hi @Pete C

please take a look at the following presentation: Cisco Live BRKSEC-3690. (search for ip device tracking).

Hope this helps !!!

Re: Authentication host-mode multi-auth

thomas — Tue, 26 Jan 2021 23:52:05 GMT

See ISE Secure Wired Access Prescriptive Deployment Guide > MAC Limits :

This does not limit the number of endpoints from connecting or authenticating on the port. Use limit address-count maximum CLI under the device-tracking policy to limit the number of endpoints allowed to use identity-based services.

c9300-Sw(config)#device-tracking policy IPDT_POLICY
c9300-Sw(config-device-tracking)#no protocol udp
c9300-Sw(config-device-tracking)#tracking enable
c9300-Sw(config-device-tracking)#limit address-count 10